gafgyt | 2ac6e36c69e58e529198df4c33649517eb78582ca381e51ca7cc248b5fe55863 | Triage

Sharing

General

Target

05f3e69af94ba2858f7a9c8c646a9620.bin
Size

66KB
Sample

250108-bcpy7aypdr
MD5

24d16c6f89f0adf39b8a746817643ae7
SHA1

eca0902fa2e5235a8e0740ed7faa536fdcc71450
SHA256

2ac6e36c69e58e529198df4c33649517eb78582ca381e51ca7cc248b5fe55863
SHA512

653fbcb4f8d0388ed32e90eeb2af0bb094e91b674f49e41aec0bae3ee2d2795077914d800ca73a151b220beb9601d40f522453083d44b9860a0c21ad959bcf19
SSDEEP

1536:UOMiEftPxHw/+Zmi+JUYw898x/4+bYRk6ceucSVN2yICibmKHW0cE:U3iqZG+ZmiSBwq8x/4+bYRk6+hNBibme

Score

10^/10

gafgyt discovery

Malware Config

Extracted

Family

gafgyt

C2

185.103.102.219:4258

Targets

- Target
  
  850b16592f84f97f7610403f51108d3d3c284b14b31126819c74cd9330103d35.elf
- Size
  
  150KB
- MD5
  
  05f3e69af94ba2858f7a9c8c646a9620
- SHA1
  
  73b411a2961ef068b13b4da32c922e172718aaef
- SHA256
  
  850b16592f84f97f7610403f51108d3d3c284b14b31126819c74cd9330103d35
- SHA512
  
  aaf75eba68dd4d6b9fff0bb0d7bb83639bb99fdfb5f9cc5d51c3e473949bf8b6f80002150b6db78e42e27595cdcb7c045fec1cfc9b5fff30e2892e187e3a9fd4
- SSDEEP
  
  3072:/dQbnQao0HawD+zQNz7gv5hZ1GHJWM/9kxHmpwTsL/QMyn:VmQao0H3D9z7i5hZ1GHIM/9kNmpwTsLS
Score

6^/10

discovery
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1