gafgyt | 7cce5c391c5d5877c7a4488c611d5d7bd9904fc28cfc4203bab1208827dac946 | Triage

Sharing

General

Target

e9e5d60b0ba82ea472f5cfb1051c8fb5_JaffaCakes118
Size

126KB
Sample

241213-e44s7szpcm
MD5

e9e5d60b0ba82ea472f5cfb1051c8fb5
SHA1

9099aeaef814dcb53a8b081b30f20574f26542ab
SHA256

7cce5c391c5d5877c7a4488c611d5d7bd9904fc28cfc4203bab1208827dac946
SHA512

96886b0361a962ee04a6cc1657427a69469abe27f16f605d5d92c31e0fb3f214fff27aa8d7a6aa750be79e8bf5594f9fdaef84993e1b91bb4e11b10decfecd05
SSDEEP

3072:6jVlyaL5JCrIpv04sebstiEiJmP46aQyfPluesNb:yoCJCN4seb8YmP46aQyfPluesNb

Score

10^/10

gafgyt defense_evasion discovery

Malware Config

Targets

- Target
  
  e9e5d60b0ba82ea472f5cfb1051c8fb5_JaffaCakes118
- Size
  
  126KB
- MD5
  
  e9e5d60b0ba82ea472f5cfb1051c8fb5
- SHA1
  
  9099aeaef814dcb53a8b081b30f20574f26542ab
- SHA256
  
  7cce5c391c5d5877c7a4488c611d5d7bd9904fc28cfc4203bab1208827dac946
- SHA512
  
  96886b0361a962ee04a6cc1657427a69469abe27f16f605d5d92c31e0fb3f214fff27aa8d7a6aa750be79e8bf5594f9fdaef84993e1b91bb4e11b10decfecd05
- SSDEEP
  
  3072:6jVlyaL5JCrIpv04sebstiEiJmP46aQyfPluesNb:yoCJCN4seb8YmP46aQyfPluesNb
Score

7^/10

defense_evasion discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery