General

  • Target

    hidakibest.mpsl.elf

  • Size

    141KB

  • Sample

    241217-hh292atjft

  • MD5

    a2d174a726d648489403d98fa61f7b39

  • SHA1

    5f0456fc4b94a1e0abe5060288a28df787d010a5

  • SHA256

    529845bcadbd2e7aa02860e86c70187694ed3b4ec2543c2128b1a2b58d96e529

  • SHA512

    a989dca2642bdefefb58b4d3cfe97446ea44ab32944a7d4d54e00dfcc42adc89bf90457a481b38e2dc18178cb93990cebed8881cbd70e187608bace7d75bfec5

  • SSDEEP

    3072:lBXpqf9VHGn7vsl5htpRvHpVFm0/5ApYADn:llp4Wvsl5htvp7m0/5ASADn

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

49.0.254.78:4258

Targets

    • Target

      hidakibest.mpsl.elf

    • Size

      141KB

    • MD5

      a2d174a726d648489403d98fa61f7b39

    • SHA1

      5f0456fc4b94a1e0abe5060288a28df787d010a5

    • SHA256

      529845bcadbd2e7aa02860e86c70187694ed3b4ec2543c2128b1a2b58d96e529

    • SHA512

      a989dca2642bdefefb58b4d3cfe97446ea44ab32944a7d4d54e00dfcc42adc89bf90457a481b38e2dc18178cb93990cebed8881cbd70e187608bace7d75bfec5

    • SSDEEP

      3072:lBXpqf9VHGn7vsl5htpRvHpVFm0/5ApYADn:llp4Wvsl5htvp7m0/5ASADn

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks