gafgyt | e1658b88d41ea23268131145d147a8e0905ec647b16ec13b0edcb2776f2b1884 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ee7b2f0022a9484745b410d3ce931d0a_JaffaCakes118
Size

154KB
Sample

240920-1mct2szbrh
MD5

ee7b2f0022a9484745b410d3ce931d0a
SHA1

5f77d02199ba6f640fd421e43f0bd10217f668ef
SHA256

e1658b88d41ea23268131145d147a8e0905ec647b16ec13b0edcb2776f2b1884
SHA512

5f82b0d5a3ec446cccb10b04ebe0375aec7f43a8d7e61e19db3804a67175aee38e0750a01f945a00b38aaee890699826408765bbaca6ec5896349eb337273faa
SSDEEP

3072:AXqUTS5M2I/wQcarFN5hAYrhdMswqTEC/4j0:lMS5M2IY3aBN5hAYrhdMswqTEC/4j0

Score

10^/10

gafgyt discovery

Malware Config

Targets

- Target
  
  ee7b2f0022a9484745b410d3ce931d0a_JaffaCakes118
- Size
  
  154KB
- MD5
  
  ee7b2f0022a9484745b410d3ce931d0a
- SHA1
  
  5f77d02199ba6f640fd421e43f0bd10217f668ef
- SHA256
  
  e1658b88d41ea23268131145d147a8e0905ec647b16ec13b0edcb2776f2b1884
- SHA512
  
  5f82b0d5a3ec446cccb10b04ebe0375aec7f43a8d7e61e19db3804a67175aee38e0750a01f945a00b38aaee890699826408765bbaca6ec5896349eb337273faa
- SSDEEP
  
  3072:AXqUTS5M2I/wQcarFN5hAYrhdMswqTEC/4j0:lMS5M2IY3aBN5hAYrhdMswqTEC/4j0
Score

7^/10

discovery
- Deletes itself
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1