General

  • Target

    hidakibest.x86.elf

  • Size

    106KB

  • Sample

    250220-wnp4jstlz2

  • MD5

    fa1a16bc44812a0f48fde8f54103db16

  • SHA1

    b80f4807a61834a02102f2f38ead23fc1a8facf1

  • SHA256

    b4752ddf291699be63d00b3de146d9af1795332482bc77c3f5087405dcde6560

  • SHA512

    4b659892794f2177fafac931198a4e5ca452c987c6ab273bd83637c9cff4fe6a5f303b20725eb88b4a0d1ad1b0a32be39df96ae74b6a4a33303315d630b1f0d6

  • SSDEEP

    3072:j6dye4BmJQZphaZw/1vc4LAzkSXmdRWaLHgb4:dZphaZcOrmdRWaDgb4

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

64.188.99.14:4258

Targets

    • Target

      hidakibest.x86.elf

    • Size

      106KB

    • MD5

      fa1a16bc44812a0f48fde8f54103db16

    • SHA1

      b80f4807a61834a02102f2f38ead23fc1a8facf1

    • SHA256

      b4752ddf291699be63d00b3de146d9af1795332482bc77c3f5087405dcde6560

    • SHA512

      4b659892794f2177fafac931198a4e5ca452c987c6ab273bd83637c9cff4fe6a5f303b20725eb88b4a0d1ad1b0a32be39df96ae74b6a4a33303315d630b1f0d6

    • SSDEEP

      3072:j6dye4BmJQZphaZw/1vc4LAzkSXmdRWaLHgb4:dZphaZcOrmdRWaDgb4

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks