General

  • Target

    hidakibest.arm4.elf

  • Size

    112KB

  • Sample

    241127-mq39hswqhp

  • MD5

    2dc985c38976ca628263cd757ac46c2d

  • SHA1

    368505a73e3e628170f7f26b8bf573b460356f9e

  • SHA256

    a32dfaf32e717b6ed5f1066fbd48244345eceec49071680236e41337128e2267

  • SHA512

    fc077631cb24b98504a129de5608c46fba1c40d4747e3cd07033da63e0a5c52f78f5a64a1337b65ce28d5e3af27427cf0f3a49d03bfced09f044260e9d4695b3

  • SSDEEP

    3072:vhfviOui5FCRSUaVejY68tw5hqSr3hGm0Qxu1bXWIn:pvfUQVejYXtw5hqSr3hGm0Qxu1rWIn

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

166.88.225.38:4258

Targets

    • Target

      hidakibest.arm4.elf

    • Size

      112KB

    • MD5

      2dc985c38976ca628263cd757ac46c2d

    • SHA1

      368505a73e3e628170f7f26b8bf573b460356f9e

    • SHA256

      a32dfaf32e717b6ed5f1066fbd48244345eceec49071680236e41337128e2267

    • SHA512

      fc077631cb24b98504a129de5608c46fba1c40d4747e3cd07033da63e0a5c52f78f5a64a1337b65ce28d5e3af27427cf0f3a49d03bfced09f044260e9d4695b3

    • SSDEEP

      3072:vhfviOui5FCRSUaVejY68tw5hqSr3hGm0Qxu1bXWIn:pvfUQVejYXtw5hqSr3hGm0Qxu1rWIn

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks