General

  • Target

    hidakibest.mpsl.elf

  • Size

    141KB

  • Sample

    241204-3h9z4aspam

  • MD5

    c432dad85530f5411df026056b23a4c3

  • SHA1

    3e890cacc7522cea3988735e46770bc8d5692576

  • SHA256

    fc0fdd71443136c850d429f3e74e5a2ef11adf1e5aa42847984de69cfde4a972

  • SHA512

    440876891886c430b9f772a9f1cf343b1e38505adca0f325cacff464a56f44a4f72b58a2d911c7b4d3865c3ca7d98ed67d58d56ead8c66198b232ecf1e1a2262

  • SSDEEP

    3072:lBXpqf9VHGn7vsp5htpRvHpVFm0/5ApYADn:llp4Wvsp5htvp7m0/5ASADn

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

172.234.21.34:4258

Targets

    • Target

      hidakibest.mpsl.elf

    • Size

      141KB

    • MD5

      c432dad85530f5411df026056b23a4c3

    • SHA1

      3e890cacc7522cea3988735e46770bc8d5692576

    • SHA256

      fc0fdd71443136c850d429f3e74e5a2ef11adf1e5aa42847984de69cfde4a972

    • SHA512

      440876891886c430b9f772a9f1cf343b1e38505adca0f325cacff464a56f44a4f72b58a2d911c7b4d3865c3ca7d98ed67d58d56ead8c66198b232ecf1e1a2262

    • SSDEEP

      3072:lBXpqf9VHGn7vsp5htpRvHpVFm0/5ApYADn:llp4Wvsp5htvp7m0/5ASADn

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks