General

  • Target

    hidakibest.arm5.elf

  • Size

    150KB

  • Sample

    250106-nxv26avrez

  • MD5

    3b6ef94ff7bfeaba0f600ea8938a5a85

  • SHA1

    ed5da5fda59152df8fab8d34af537116a0c1dfd4

  • SHA256

    2084f2448a61fe7fa9b857d5be2c0d25806625c317132acfc185538419dc8b0b

  • SHA512

    f287b8c5200621dabdcfed405c86c8d2acf7648f1b5b6f0da0966be48b125c11d6d08f1d6b9f1ba97dc88682f0fc5cf9a4ab66ba65d750e17762684d837e4b48

  • SSDEEP

    3072:/dQbnQao0HawD+zQNz7gv5hZ1GU2WV7kxHmpwTsL/QMyn:VmQao0H3D9z7i5hZ1GU2WV7kNmpwTsLS

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

185.103.102.219:4258

Targets

    • Target

      hidakibest.arm5.elf

    • Size

      150KB

    • MD5

      3b6ef94ff7bfeaba0f600ea8938a5a85

    • SHA1

      ed5da5fda59152df8fab8d34af537116a0c1dfd4

    • SHA256

      2084f2448a61fe7fa9b857d5be2c0d25806625c317132acfc185538419dc8b0b

    • SHA512

      f287b8c5200621dabdcfed405c86c8d2acf7648f1b5b6f0da0966be48b125c11d6d08f1d6b9f1ba97dc88682f0fc5cf9a4ab66ba65d750e17762684d837e4b48

    • SSDEEP

      3072:/dQbnQao0HawD+zQNz7gv5hZ1GU2WV7kxHmpwTsL/QMyn:VmQao0H3D9z7i5hZ1GU2WV7kNmpwTsLS

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks