General

  • Target

    hidakibest.x86.elf

  • Size

    106KB

  • Sample

    241217-hh292atqgl

  • MD5

    1569bff8910fc16180444b7416918073

  • SHA1

    4ed7af9f2ae75c52ed85c7baa3daa0cae143de99

  • SHA256

    c00d74f99b78f118569627dbf80562fd219c53b4a9e279ff78740b5fc65df625

  • SHA512

    5f0f797c4bb7a1e748ffa6a40fa6051fbe92966405dc9487ece9968868bf13097887812f96cc76b08908451fcddf56fe92dc0459b6d1990ae31af97e82c04f94

  • SSDEEP

    3072:j6dye4BmJQOphaZw/1vc4QAzkSXmdRWaLHgb4:dOphaZcjrmdRWaDgb4

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

49.0.254.78:4258

Targets

    • Target

      hidakibest.x86.elf

    • Size

      106KB

    • MD5

      1569bff8910fc16180444b7416918073

    • SHA1

      4ed7af9f2ae75c52ed85c7baa3daa0cae143de99

    • SHA256

      c00d74f99b78f118569627dbf80562fd219c53b4a9e279ff78740b5fc65df625

    • SHA512

      5f0f797c4bb7a1e748ffa6a40fa6051fbe92966405dc9487ece9968868bf13097887812f96cc76b08908451fcddf56fe92dc0459b6d1990ae31af97e82c04f94

    • SSDEEP

      3072:j6dye4BmJQOphaZw/1vc4QAzkSXmdRWaLHgb4:dOphaZcjrmdRWaDgb4

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks