gafgyt | 744f022594cc46a87af76d8b2068ecfae6ac8053ac8adf74ca014f40c18ad70e | Triage

Sharing

General

Target

JaffaCakes118_744f022594cc46a87af76d8b2068ecfae6ac8053ac8adf74ca014f40c18ad70e
Size

75KB
Sample

241224-t4fhya1qgs
MD5

1d5916a88981bbac845aff9bd4b78dda
SHA1

cba2f891098251ca8406e0dd27bbe6594c4b6341
SHA256

744f022594cc46a87af76d8b2068ecfae6ac8053ac8adf74ca014f40c18ad70e
SHA512

3171ad2dbce430b3f17140247dc59a6153ae08d4e650a216ff83b9450046bd5fd0dc5cb6963abfef9cea3ee54af5f71adc3fd547345d25534f8f5727f5634737
SSDEEP

1536:PwZTgJnDX4Gc+0hsV3ikg80DL6RilMLjIr+9:PwZTgJnD42csVSt80H6J/j9

Score

10^/10

gafgyt discovery

Malware Config

Extracted

Family

gafgyt

C2

45.140.188.40:1194

Targets

- Target
  
  94868968b95abcbbc4c5265cbb21de309333d533fcb0fd77e7b1d3e4e37cc30c
- Size
  
  210KB
- MD5
  
  46267a81556ebcf0b55bd580d9b5d681
- SHA1
  
  abd003e476c45ac626e2fce403a8006208bd08ba
- SHA256
  
  94868968b95abcbbc4c5265cbb21de309333d533fcb0fd77e7b1d3e4e37cc30c
- SHA512
  
  18704c2d0c1dd07ced7ab8d25deaa992f592c8c7e40d7b8a9eaf5feefe764855a0ad1c0fdf330fb4883763703835371aea8945231a23884664d49a5cb47edf1c
- SSDEEP
  
  3072:RH2f5PcP0CaNeMKg04dXdb6TIYAlnoLi39IaGdx6Nc/9kixPOdVmN3Ko5yDOH/px:RH2talaC1Y60pIy9ciBRoPcmyW492hSk
Score

6^/10

discovery
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1