gafgyt | d192d892243d1d666da99f66da1933a2bc121744092b777ed11a3c03f3d36b7f | Triage

Sharing

General

Target

d9f96734df11b555bde3c1805e03dcae_JaffaCakes118
Size

101KB
Sample

241209-rcd5pavmbn
MD5

d9f96734df11b555bde3c1805e03dcae
SHA1

eba5ebfd64c74caec69167cac1ea17777ae793fd
SHA256

d192d892243d1d666da99f66da1933a2bc121744092b777ed11a3c03f3d36b7f
SHA512

bd0330bca0646c355d5316dcb1e344354b58702a8ce2185fc8fcc613cb1126712789c92a6661208ff490d7b0906a2f072d3152ff24befe1c2c8127274c26b4ec
SSDEEP

3072:wW8FUmgujld6Mkxm6AJ+4f+HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f+HmmFVcqq0GnDZT

Score

10^/10

gafgyt defense_evasion discovery linux

Malware Config

Targets

- Target
  
  d9f96734df11b555bde3c1805e03dcae_JaffaCakes118
- Size
  
  101KB
- MD5
  
  d9f96734df11b555bde3c1805e03dcae
- SHA1
  
  eba5ebfd64c74caec69167cac1ea17777ae793fd
- SHA256
  
  d192d892243d1d666da99f66da1933a2bc121744092b777ed11a3c03f3d36b7f
- SHA512
  
  bd0330bca0646c355d5316dcb1e344354b58702a8ce2185fc8fcc613cb1126712789c92a6661208ff490d7b0906a2f072d3152ff24befe1c2c8127274c26b4ec
- SSDEEP
  
  3072:wW8FUmgujld6Mkxm6AJ+4f+HmmFVcqq0GnDZT:wJFv4Lm6AJ+4f+HmmFVcqq0GnDZT
Score

7^/10

defense_evasion discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery