General

  • Target

    hidakibest.x86.elf

  • Size

    106KB

  • Sample

    241128-11mamsyjbp

  • MD5

    e8ec3e3c46140b0c44e5c9b537c7a145

  • SHA1

    cedebeed5f2b2edefd192f4954fa09205f72d796

  • SHA256

    37ce51260eacb8df6851bbb49177eb7c7d5b371aa077c0bc1cdfd4350ab90e6d

  • SHA512

    7722560f7c83d736393a343cddec94ad19cf895f63158143c8bcf7ffde3226778cf670764f3009b74083548f139ce25758c66b809fd3bd67d4bfa92294b18588

  • SSDEEP

    3072:j6dye4BmJQFphaZw/1vc45AzkSXmdRWaLHgb4:dFphaZcErmdRWaDgb4

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

185.177.25.101:4258

Targets

    • Target

      hidakibest.x86.elf

    • Size

      106KB

    • MD5

      e8ec3e3c46140b0c44e5c9b537c7a145

    • SHA1

      cedebeed5f2b2edefd192f4954fa09205f72d796

    • SHA256

      37ce51260eacb8df6851bbb49177eb7c7d5b371aa077c0bc1cdfd4350ab90e6d

    • SHA512

      7722560f7c83d736393a343cddec94ad19cf895f63158143c8bcf7ffde3226778cf670764f3009b74083548f139ce25758c66b809fd3bd67d4bfa92294b18588

    • SSDEEP

      3072:j6dye4BmJQFphaZw/1vc45AzkSXmdRWaLHgb4:dFphaZcErmdRWaDgb4

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks