General

  • Target

    2fdccc656e1418d653a20004da2ba725

  • Size

    234KB

  • Sample

    231219-2tlwzahee2

  • MD5

    2fdccc656e1418d653a20004da2ba725

  • SHA1

    cfbea5d2a90bf3d1be6a067ae58b9bbd10b47c61

  • SHA256

    11796b13452f0c12dddb0a5e409b0e0ddea82031cd32efeb73212c5d8daedde7

  • SHA512

    6855116be9bf5552c441cb6f224881f360878d5bd8b8303811780b055d9184e66d18395fb61506d0faff891091c245e948e5814333a6d4fbe7f5a34a29677f46

  • SSDEEP

    3072:z+rd9k+s3HsVP29FrvrG6qR/49qHEkuOSX:z+rd7YMVO9VXqR/49qHEkuOSX

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

89.34.237.189:75

Targets

    • Target

      2fdccc656e1418d653a20004da2ba725

    • Size

      234KB

    • MD5

      2fdccc656e1418d653a20004da2ba725

    • SHA1

      cfbea5d2a90bf3d1be6a067ae58b9bbd10b47c61

    • SHA256

      11796b13452f0c12dddb0a5e409b0e0ddea82031cd32efeb73212c5d8daedde7

    • SHA512

      6855116be9bf5552c441cb6f224881f360878d5bd8b8303811780b055d9184e66d18395fb61506d0faff891091c245e948e5814333a6d4fbe7f5a34a29677f46

    • SSDEEP

      3072:z+rd9k+s3HsVP29FrvrG6qR/49qHEkuOSX:z+rd7YMVO9VXqR/49qHEkuOSX

    Score
    7/10
    • Changes its process name

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks