General

  • Target

    hidakibest.mips.elf

  • Size

    141KB

  • Sample

    250220-wnqebatlz3

  • MD5

    24fd1bd291809e50e03dff752d3112d9

  • SHA1

    a8bd45f666ce4c8d55375754553df0fd1ec6a08a

  • SHA256

    165059466add39037ed7af5682f7f9a8492e8da0174a8003281c171a8ba9b529

  • SHA512

    7bbd19622ea13fcc2d3201915ae430dc5b2d6ebdfd340dd71230b2ff69d4b8f0130cb8e9b8708c485b60181336b58ebcb743b7f40492a9e55dafa121e5ae2dc4

  • SSDEEP

    3072:sGGNZfCos2pA4FCa5hvikTam0/5ApYADn:hACyK40a5hvi9m0/5ASADn

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

64.188.99.14:4258

Targets

    • Target

      hidakibest.mips.elf

    • Size

      141KB

    • MD5

      24fd1bd291809e50e03dff752d3112d9

    • SHA1

      a8bd45f666ce4c8d55375754553df0fd1ec6a08a

    • SHA256

      165059466add39037ed7af5682f7f9a8492e8da0174a8003281c171a8ba9b529

    • SHA512

      7bbd19622ea13fcc2d3201915ae430dc5b2d6ebdfd340dd71230b2ff69d4b8f0130cb8e9b8708c485b60181336b58ebcb743b7f40492a9e55dafa121e5ae2dc4

    • SSDEEP

      3072:sGGNZfCos2pA4FCa5hvikTam0/5ApYADn:hACyK40a5hvi9m0/5ASADn

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks