gafgyt | f571dc78752a8b80439af750c1349b67ab80ea00920addcc3789b957263828f3 | Triage

Sharing

General

Target

19aeb425aa11510ba4d8f6bde0c2bebe.bin
Size

67KB
Sample

241124-bdhlhaskaq
MD5

f9b60f993e07d6120bf3d773ca0d7883
SHA1

e13588e5d1dcca223d3421690ded52a137c0c47a
SHA256

f571dc78752a8b80439af750c1349b67ab80ea00920addcc3789b957263828f3
SHA512

4312297d269dd48709494f23289bd2d229d4de7ffe0caba1b0d2d13a44531cb5306870030c7c8d42a6bbc10278235b38eb710b48df723d01927ab4a66fb66893
SSDEEP

1536:rVWI1Sxg7nIy0D45CT2FXZKN4B1RhJBUY7is8K:r8ISg7IzYq2K2BhJBZ7B8K

Score

10^/10

gafgyt discovery

Malware Config

Extracted

Family

gafgyt

C2

188.245.84.178:1865

Targets

- Target
  
  35c8622596f89014d9e44b634610c2f6940406aa45918a873e808f94af4e4913.elf
- Size
  
  156KB
- MD5
  
  19aeb425aa11510ba4d8f6bde0c2bebe
- SHA1
  
  7cccba8567b084ba870dce88c7da597313264260
- SHA256
  
  35c8622596f89014d9e44b634610c2f6940406aa45918a873e808f94af4e4913
- SHA512
  
  dd68d5948d2e3c27526245ec4516883f4e64f209fcbfc322700029a05d991c43832f84b1ce0d1d1db9d16bdcb39199ecabd362a2dfb7046625e427bb5f3c859f
- SSDEEP
  
  3072:T1g2/eINNlzx2kkQCMOaQcvBKYnyLRM/9pSQomFwfBxKQodn:hg2hNNlzIkk/MOa/UYnydM/9LomFwfBC
Score

6^/10

discovery
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1