General

  • Target

    hidakibest.arm4.elf

  • Size

    112KB

  • Sample

    241222-sa2zeaskar

  • MD5

    0b9c50ac49e202f06421ab0bb325468e

  • SHA1

    3c3e2fa064f80ef9a9a5580abc747764c2950872

  • SHA256

    96967c1b1aec4bb2e45047e0fab0d3d793a502630a112a6dd7e1ad6d4ceabe5f

  • SHA512

    b6c5fb6a6a5ce7b8575db7b78d26cd24cfa9e3f66a6a0760c5442a5f6422432aec1ca5e79cc121b8a14303ccdaea1fd1aca9378297c3507157ababc90ddee05e

  • SSDEEP

    3072:vhfviOui5FCRSUaVejY68tu5hqSr3hGm0Qxu1bXWIn:pvfUQVejYXtu5hqSr3hGm0Qxu1rWIn

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

185.216.71.152:4258

Targets

    • Target

      hidakibest.arm4.elf

    • Size

      112KB

    • MD5

      0b9c50ac49e202f06421ab0bb325468e

    • SHA1

      3c3e2fa064f80ef9a9a5580abc747764c2950872

    • SHA256

      96967c1b1aec4bb2e45047e0fab0d3d793a502630a112a6dd7e1ad6d4ceabe5f

    • SHA512

      b6c5fb6a6a5ce7b8575db7b78d26cd24cfa9e3f66a6a0760c5442a5f6422432aec1ca5e79cc121b8a14303ccdaea1fd1aca9378297c3507157ababc90ddee05e

    • SSDEEP

      3072:vhfviOui5FCRSUaVejY68tu5hqSr3hGm0Qxu1bXWIn:pvfUQVejYXtu5hqSr3hGm0Qxu1rWIn

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks