General

  • Target

    hidakibest.arm5.elf

  • Size

    150KB

  • Sample

    241222-sa2zeaskaq

  • MD5

    4a4904e2a861a3b1181d48a97a20e0a1

  • SHA1

    49c3fcfaf0d8ee5e429b1d2a3717ef8d20a33651

  • SHA256

    b101a75e8db5b23a67d9942e90c2bba636dc331abf8a3eec9f77eaaf2b41eda7

  • SHA512

    b0f2a26e5dad50b3d31b86fa8dedb13eeeb89d7c652f25dce5e51aae4ca51bf71f02d7d9a402f4060c919dff195dca6bf4b0f1ca29e49d2bddaaa4957f96d623

  • SSDEEP

    3072:Tdbmn8aAEHqgSkano1DTAD5hWTGU2WV7lxXmpwTsL/QMyn:he8aAEHKkdDTW5hWTGU2WV7ldmpwTsLS

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

185.216.71.152:4258

Targets

    • Target

      hidakibest.arm5.elf

    • Size

      150KB

    • MD5

      4a4904e2a861a3b1181d48a97a20e0a1

    • SHA1

      49c3fcfaf0d8ee5e429b1d2a3717ef8d20a33651

    • SHA256

      b101a75e8db5b23a67d9942e90c2bba636dc331abf8a3eec9f77eaaf2b41eda7

    • SHA512

      b0f2a26e5dad50b3d31b86fa8dedb13eeeb89d7c652f25dce5e51aae4ca51bf71f02d7d9a402f4060c919dff195dca6bf4b0f1ca29e49d2bddaaa4957f96d623

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAD5hWTGU2WV7lxXmpwTsL/QMyn:he8aAEHKkdDTW5hWTGU2WV7ldmpwTsLS

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks