gafgyt | 4d19ced2ef52e5d44b0c089c6200433a79ce7cb41859060c0086d6fd6d48399e | Triage

Sharing

General

Target

2521efbff8e8a6bdcdb1eaab862c4835.bin
Size

51KB
Sample

241215-bg4cda1pbj
MD5

b17ecb8fd030f3d42355ad60fd4a6295
SHA1

de9b41ecd704bea8fa9a1a4c0b592cc392935e7a
SHA256

4d19ced2ef52e5d44b0c089c6200433a79ce7cb41859060c0086d6fd6d48399e
SHA512

8faf7d03c6604193b4406425e2b8827a55b54b41bb830cfba16ddb722e3c73e76b97b100ca02fabe81b7224792aa15248913b67c4c28f3daf783e9ee608e3523
SSDEEP

1536:Qe794LAeGbJoChiBkKcixsYubNBQMmyRvgrg:QK9iAUNVci5WQbIYU

Score

10^/10

gafgyt discovery

Malware Config

Extracted

Family

gafgyt

C2

154.213.187.62:1865

Targets

- Target
  
  ffa5146ffa217aa42b4f38d3d8b000d50c4f43328a8257a5514abf53a51631c2.elf
- Size
  
  118KB
- MD5
  
  2521efbff8e8a6bdcdb1eaab862c4835
- SHA1
  
  6ea045054f9fd8799f7cddd2ef05729baab46531
- SHA256
  
  ffa5146ffa217aa42b4f38d3d8b000d50c4f43328a8257a5514abf53a51631c2
- SHA512
  
  22f5158fbced71f61ef9b6e75564b8633f58dcc09d78535c8bee01b982e0561c24672c29ca10e2cd8beed2d10a7ad237a2839530b998b826146dd44df042e556
- SSDEEP
  
  3072:ekYPUfsgnsb0J2ag/VfVkDuuN4g+mTQOY5NX3cn:9YPUfsgEo2a0VkDuxg+mTQOY5R3cn
Score

6^/10

discovery
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1