gafgyt | 7023e7c327eeba43e69a2bddabf5e0af57a4889d61839d210dd5b01c643d0e0c | Triage

Sharing

General

Target

f4cef2937a56fcd5521941cfb2de5fd5_JaffaCakes118
Size

139KB
Sample

241215-ty6g6s1pdl
MD5

f4cef2937a56fcd5521941cfb2de5fd5
SHA1

85c694c8f1f95c667c3952ad891402a65caf870c
SHA256

7023e7c327eeba43e69a2bddabf5e0af57a4889d61839d210dd5b01c643d0e0c
SHA512

7f718335c6e29c0a4c57fc357f23b2271bf7802b3cf5f68c742d929bcc31dbddc682433e726f756abce655020f419a5bf694d2241c9489f60aa8ef2322ba2f1b
SSDEEP

3072:Cv/WwsLgaq353qHiCOvhOpYqkDQHbeskmhxQwoVSUNu:KPLaq351hOpYqkLskmhxQwoVSUNu

Score

10^/10

gafgyt defense_evasion discovery

Malware Config

Targets

- Target
  
  f4cef2937a56fcd5521941cfb2de5fd5_JaffaCakes118
- Size
  
  139KB
- MD5
  
  f4cef2937a56fcd5521941cfb2de5fd5
- SHA1
  
  85c694c8f1f95c667c3952ad891402a65caf870c
- SHA256
  
  7023e7c327eeba43e69a2bddabf5e0af57a4889d61839d210dd5b01c643d0e0c
- SHA512
  
  7f718335c6e29c0a4c57fc357f23b2271bf7802b3cf5f68c742d929bcc31dbddc682433e726f756abce655020f419a5bf694d2241c9489f60aa8ef2322ba2f1b
- SSDEEP
  
  3072:Cv/WwsLgaq353qHiCOvhOpYqkDQHbeskmhxQwoVSUNu:KPLaq351hOpYqkLskmhxQwoVSUNu
Score

7^/10

defense_evasion discovery
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscovery