General

  • Target

    hidakibest.arm7.elf

  • Size

    150KB

  • Sample

    241222-sbk3aaskcl

  • MD5

    52d0ae13c857d4eb4234dc595722dccc

  • SHA1

    8e38ea859ff096811f869980013931836a4b5be5

  • SHA256

    504a1d38ce1c64c802409879813a4707e35d5e0123e077e197ff6ab14627bc1a

  • SHA512

    dc8cbeb911cf55effdb0fd7fbc71fd388374bbc8b5e9ac7f8c616292934e61d8f696c48e76b514cb77ca34fed00c0b47a734fb1073c2579d09d96f88224a6665

  • SSDEEP

    3072:Tdbmn8aAEHqgSkano1DTAD5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTW5hWTGHIM/9ldmpwTsLS

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

185.216.71.152:4258

Targets

    • Target

      hidakibest.arm7.elf

    • Size

      150KB

    • MD5

      52d0ae13c857d4eb4234dc595722dccc

    • SHA1

      8e38ea859ff096811f869980013931836a4b5be5

    • SHA256

      504a1d38ce1c64c802409879813a4707e35d5e0123e077e197ff6ab14627bc1a

    • SHA512

      dc8cbeb911cf55effdb0fd7fbc71fd388374bbc8b5e9ac7f8c616292934e61d8f696c48e76b514cb77ca34fed00c0b47a734fb1073c2579d09d96f88224a6665

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAD5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDTW5hWTGHIM/9ldmpwTsLS

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks