gafgyt | 85fb7e57ee36c8dceaa78dece7bbdc3a2cda11a37bfbe25c6cbec9c1bc83b068 | Triage

Sharing

General

Target

c4271b80e83d64e10339bff159b01038_JaffaCakes118
Size

138KB
Sample

241204-yq5ccstrbm
MD5

c4271b80e83d64e10339bff159b01038
SHA1

795456c6f12631037ef2b7f6adb34cb39215b927
SHA256

85fb7e57ee36c8dceaa78dece7bbdc3a2cda11a37bfbe25c6cbec9c1bc83b068
SHA512

9f961ad461fe0a70c85def215c4731195c321f7a0ef34c866ac8e0f3321e7098a18279bf338a2c758279b9002b5269a8776c6c602a9424098e54354c60f31fb3
SSDEEP

3072:c8JP01xx3oWOfifAeX9rHHs/zBvK8f8zPnS/6o6lr2aXe/Nz/tgLER3B+GA+KH9U:rJPp7HxpRHB6cmuThaGsE7I2TNb

Score

10^/10

gafgyt defense_evasion discovery

Malware Config

Targets

- Target
  
  c4271b80e83d64e10339bff159b01038_JaffaCakes118
- Size
  
  138KB
- MD5
  
  c4271b80e83d64e10339bff159b01038
- SHA1
  
  795456c6f12631037ef2b7f6adb34cb39215b927
- SHA256
  
  85fb7e57ee36c8dceaa78dece7bbdc3a2cda11a37bfbe25c6cbec9c1bc83b068
- SHA512
  
  9f961ad461fe0a70c85def215c4731195c321f7a0ef34c866ac8e0f3321e7098a18279bf338a2c758279b9002b5269a8776c6c602a9424098e54354c60f31fb3
- SSDEEP
  
  3072:c8JP01xx3oWOfifAeX9rHHs/zBvK8f8zPnS/6o6lr2aXe/Nz/tgLER3B+GA+KH9U:rJPp7HxpRHB6cmuThaGsE7I2TNb
Score

7^/10

defense_evasion discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery