General

  • Target

    hidakibest.x86.elf

  • Size

    106KB

  • Sample

    250106-n34aqayjbq

  • MD5

    e647f21a88978d9b2f8feaab47af5c1f

  • SHA1

    eee3a62d5c2e98069e33f6a296f58b727d2052ee

  • SHA256

    c3eed74ffd5af3a0c06956e2825ef541658d76849b4c471b0c7c60f06d56afc5

  • SHA512

    a98f8aa1b2cf431456325a344185f65531ab3356927caf74515967b8a89bbf50e040b124aa42a852a01015a6e1d86317d509051eae7fb25c83d348e6c887c722

  • SSDEEP

    3072:j6dye4BmJQWphaZw/1vc4MAzkSXmdRWaLHgb4:dWphaZcvrmdRWaDgb4

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

185.103.102.219:4258

Targets

    • Target

      hidakibest.x86.elf

    • Size

      106KB

    • MD5

      e647f21a88978d9b2f8feaab47af5c1f

    • SHA1

      eee3a62d5c2e98069e33f6a296f58b727d2052ee

    • SHA256

      c3eed74ffd5af3a0c06956e2825ef541658d76849b4c471b0c7c60f06d56afc5

    • SHA512

      a98f8aa1b2cf431456325a344185f65531ab3356927caf74515967b8a89bbf50e040b124aa42a852a01015a6e1d86317d509051eae7fb25c83d348e6c887c722

    • SSDEEP

      3072:j6dye4BmJQWphaZw/1vc4MAzkSXmdRWaLHgb4:dWphaZcvrmdRWaDgb4

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks