gafgyt | 9d199a0c9cc0990659bc428b86c103763164976271665c179ddecf363ade045b | Triage

Sharing

General

Target

c30c924a04c5e5a7a758b74395247f63
Size

70KB
Sample

231220-rh4yasahe3
MD5

c30c924a04c5e5a7a758b74395247f63
SHA1

156083535a4cab2d8e9d9f10444f9082789b4515
SHA256

9d199a0c9cc0990659bc428b86c103763164976271665c179ddecf363ade045b
SHA512

8833f0d5dde2d587f1d8cf4b6c3b8ddde6246cec1441df08fba88c40f6574e6f643db103b42fefcadc6e54c9a8585c5d8c3df54e098b380a0212409092077b60
SSDEEP

1536:BfaBN280V8+494o9nlmqe8ThfZ9i4Sggmd+lVOCjUxfg71:Bfiw8oDeVplLFfzZSggmMlVOCAxfg71

Score

10^/10

gafgyt linux

Malware Config

Extracted

Family

gafgyt

C2

138.197.5.39:23

Targets

- Target
  
  c30c924a04c5e5a7a758b74395247f63
- Size
  
  70KB
- MD5
  
  c30c924a04c5e5a7a758b74395247f63
- SHA1
  
  156083535a4cab2d8e9d9f10444f9082789b4515
- SHA256
  
  9d199a0c9cc0990659bc428b86c103763164976271665c179ddecf363ade045b
- SHA512
  
  8833f0d5dde2d587f1d8cf4b6c3b8ddde6246cec1441df08fba88c40f6574e6f643db103b42fefcadc6e54c9a8585c5d8c3df54e098b380a0212409092077b60
- SSDEEP
  
  1536:BfaBN280V8+494o9nlmqe8ThfZ9i4Sggmd+lVOCjUxfg71:Bfiw8oDeVplLFfzZSggmMlVOCAxfg71
Score

6^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1