gafgyt | 9e9e6e6ee78abe50cf080ed311e579f5592f23f54d2c3e0bec7d46d0579728a1 | Triage

Sharing

General

Target

2db2ef95c8337cc6f81fffe71132cc4b
Size

70KB
Sample

231219-2sr2ladhbp
MD5

2db2ef95c8337cc6f81fffe71132cc4b
SHA1

2c770a67f9d9d0cfb6441d0bbe2059a6665845a3
SHA256

9e9e6e6ee78abe50cf080ed311e579f5592f23f54d2c3e0bec7d46d0579728a1
SHA512

012f94d34266bfaede639858b4adbc2830b0abcf197632f25052385c8dec149c5829e20a7d6e4c272fb68c0f6a62e60a4e64a109b22781729e52f00495d7be63
SSDEEP

1536:8uY0qH/NQ27qLfEg8ZW087TrG4GmF+lVOCjUxfg71:q0qH/C2GLfcsbP6TmElVOCAxfg71

Score

10^/10

gafgyt linux

Malware Config

Extracted

Family

gafgyt

C2

204.48.16.27:666

Targets

- Target
  
  2db2ef95c8337cc6f81fffe71132cc4b
- Size
  
  70KB
- MD5
  
  2db2ef95c8337cc6f81fffe71132cc4b
- SHA1
  
  2c770a67f9d9d0cfb6441d0bbe2059a6665845a3
- SHA256
  
  9e9e6e6ee78abe50cf080ed311e579f5592f23f54d2c3e0bec7d46d0579728a1
- SHA512
  
  012f94d34266bfaede639858b4adbc2830b0abcf197632f25052385c8dec149c5829e20a7d6e4c272fb68c0f6a62e60a4e64a109b22781729e52f00495d7be63
- SSDEEP
  
  1536:8uY0qH/NQ27qLfEg8ZW087TrG4GmF+lVOCjUxfg71:q0qH/C2GLfcsbP6TmElVOCAxfg71
Score

6^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1