gafgyt | 4a8ab975106f27c0307ae95e6f1d3247cc198391c1822b36c4a14813c5c90cbc | Triage

Sharing

General

Target

JaffaCakes118_4a8ab975106f27c0307ae95e6f1d3247cc198391c1822b36c4a14813c5c90cbc
Size

75KB
Sample

241222-k12sbssmcl
MD5

cc5e6cf914db24050d0fd4bf3bd35058
SHA1

6adb1be2e319a024ec35f5f223659698cf77ff8f
SHA256

4a8ab975106f27c0307ae95e6f1d3247cc198391c1822b36c4a14813c5c90cbc
SHA512

cfd13c954d9f58790ecf7cd0c5415de63548f101850f587bb4b0cde98949d98ef233aae29fa57787289a60e6690b4097b1b85a363c876def492971c025699a56
SSDEEP

1536:jwZTgJnDX4Gc+0hsV3ikg80DL6RilMLjIr+J:jwZTgJnD42csVSt80H6J/jJ

Score

10^/10

gafgyt discovery

Malware Config

Extracted

Family

gafgyt

C2

45.140.188.40:1194

Targets

- Target
  
  94868968b95abcbbc4c5265cbb21de309333d533fcb0fd77e7b1d3e4e37cc30c
- Size
  
  210KB
- MD5
  
  46267a81556ebcf0b55bd580d9b5d681
- SHA1
  
  abd003e476c45ac626e2fce403a8006208bd08ba
- SHA256
  
  94868968b95abcbbc4c5265cbb21de309333d533fcb0fd77e7b1d3e4e37cc30c
- SHA512
  
  18704c2d0c1dd07ced7ab8d25deaa992f592c8c7e40d7b8a9eaf5feefe764855a0ad1c0fdf330fb4883763703835371aea8945231a23884664d49a5cb47edf1c
- SSDEEP
  
  3072:RH2f5PcP0CaNeMKg04dXdb6TIYAlnoLi39IaGdx6Nc/9kixPOdVmN3Ko5yDOH/px:RH2talaC1Y60pIy9ciBRoPcmyW492hSk
Score

6^/10

discovery
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1