gafgyt | cccff138c2d14b54dc125214cdbdcd19854d18f660f637f4841ddc4b53a22ac8 | Triage

Sharing

General

Target

3a34ba13dab5468fa15b013ca5f0cdda
Size

129KB
Sample

231219-2yg4ksgadr
MD5

3a34ba13dab5468fa15b013ca5f0cdda
SHA1

896ed2e78a11328e3af7c9247736c044acef25b5
SHA256

cccff138c2d14b54dc125214cdbdcd19854d18f660f637f4841ddc4b53a22ac8
SHA512

a06fefee0e3aa1a9a9bdf7fe40418ef3fc9c52d5b37f87b2b22e1b86dc5b205374e9c1a329ab450ca2bd5f0b44ffe02bc3bea9e09b776a4db6ac7e48b4dbf9a7
SSDEEP

3072:QPL1QFV1s2GF9cDawW70kFeG8Llqp+pmxATM7oPWL:NFV1ycDVW70kIlqp+pmxATM7oPWL

Score

10^/10

gafgyt linux

Malware Config

Extracted

Family

gafgyt

C2

185.222.202.68:22922

Targets

- Target
  
  3a34ba13dab5468fa15b013ca5f0cdda
- Size
  
  129KB
- MD5
  
  3a34ba13dab5468fa15b013ca5f0cdda
- SHA1
  
  896ed2e78a11328e3af7c9247736c044acef25b5
- SHA256
  
  cccff138c2d14b54dc125214cdbdcd19854d18f660f637f4841ddc4b53a22ac8
- SHA512
  
  a06fefee0e3aa1a9a9bdf7fe40418ef3fc9c52d5b37f87b2b22e1b86dc5b205374e9c1a329ab450ca2bd5f0b44ffe02bc3bea9e09b776a4db6ac7e48b4dbf9a7
- SSDEEP
  
  3072:QPL1QFV1s2GF9cDawW70kFeG8Llqp+pmxATM7oPWL:NFV1ycDVW70kIlqp+pmxATM7oPWL
Score

7^/10
- Changes its process name
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1