gafgyt | fb193c395ef01cbe155e41cf5fdf4397736272e64fd3cc9a28f35a826255c3e3 | Triage

Sharing

General

Target

03c3e21a06f67b8ff36b12eed1d89cf3_JaffaCakes118
Size

127KB
Sample

240427-2dkc7shh86
MD5

03c3e21a06f67b8ff36b12eed1d89cf3
SHA1

e4a42f794fcb3e763ffab3d91de4d50435aaf96f
SHA256

fb193c395ef01cbe155e41cf5fdf4397736272e64fd3cc9a28f35a826255c3e3
SHA512

267fb39551b4b086733451f2f5d9791c1a68906a638afe6e69cd0ae350f3cfb90f17e8865500503434ee015a0099669a30de94af490b83f6160b44b913ceac8f
SSDEEP

3072:tbv8jhuBPx+hc9TRk5HYTcbHTjEaHZse6XXMWlmKTaf0M05jGHhU+3xEYovPLF+k:tlvHMW0KTaschU+3mozGmpQAqcq3r

Score

10^/10

gafgyt

Malware Config

Extracted

Family

gafgyt

C2

205.185.120.141:3137

Targets

- Target
  
  03c3e21a06f67b8ff36b12eed1d89cf3_JaffaCakes118
- Size
  
  127KB
- MD5
  
  03c3e21a06f67b8ff36b12eed1d89cf3
- SHA1
  
  e4a42f794fcb3e763ffab3d91de4d50435aaf96f
- SHA256
  
  fb193c395ef01cbe155e41cf5fdf4397736272e64fd3cc9a28f35a826255c3e3
- SHA512
  
  267fb39551b4b086733451f2f5d9791c1a68906a638afe6e69cd0ae350f3cfb90f17e8865500503434ee015a0099669a30de94af490b83f6160b44b913ceac8f
- SSDEEP
  
  3072:tbv8jhuBPx+hc9TRk5HYTcbHTjEaHZse6XXMWlmKTaf0M05jGHhU+3xEYovPLF+k:tlvHMW0KTaschU+3mozGmpQAqcq3r
Score

6^/10
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1