gafgyt | 85ccb555ff132edf7a3f2f4ac9105cec799523d8e4b225c7e7487b6f4efa6c51 | Triage

Sharing

General

Target

c4d75627d7f98c9aef371cab6eed1af7_JaffaCakes118
Size

101KB
Sample

241204-3ja76awrgx
MD5

c4d75627d7f98c9aef371cab6eed1af7
SHA1

f00ed60e49089af839452187e7b30e2c6c66cf5c
SHA256

85ccb555ff132edf7a3f2f4ac9105cec799523d8e4b225c7e7487b6f4efa6c51
SHA512

ec1d6ea0f78b2453ca6c14e457aa7d20abbcd856bf8b8c33ef70fa66d3535f662f946a91c91b851cd17fcab60d024ed35244279b290fc580774d7275097c0999
SSDEEP

3072:wW8FUmgujld6Mkxm6AJ+4f2HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f2HmmFVcqq0GnDZT

Score

10^/10

gafgyt defense_evasion discovery linux

Malware Config

Targets

- Target
  
  c4d75627d7f98c9aef371cab6eed1af7_JaffaCakes118
- Size
  
  101KB
- MD5
  
  c4d75627d7f98c9aef371cab6eed1af7
- SHA1
  
  f00ed60e49089af839452187e7b30e2c6c66cf5c
- SHA256
  
  85ccb555ff132edf7a3f2f4ac9105cec799523d8e4b225c7e7487b6f4efa6c51
- SHA512
  
  ec1d6ea0f78b2453ca6c14e457aa7d20abbcd856bf8b8c33ef70fa66d3535f662f946a91c91b851cd17fcab60d024ed35244279b290fc580774d7275097c0999
- SSDEEP
  
  3072:wW8FUmgujld6Mkxm6AJ+4f2HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f2HmmFVcqq0GnDZT
Score

7^/10

defense_evasion discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery