General

  • Target

    hidakibest.arm7.elf

  • Size

    150KB

  • Sample

    250220-wtrvbstmy5

  • MD5

    bb84dd89a14db23194164a7169b475a6

  • SHA1

    7cf0f6fa668d8a29a1005169f9283d416a39a219

  • SHA256

    d2f903112e15d99363654193db43242e9bc3364b434490fdb8d4e5d4d0d3edaf

  • SHA512

    7df1000ae468624f59c9c4a57b8d7eee037e49533d243bc26660fdaf7139df81bed84b3e0bc69a47138998249983c330c50b9f876d7f16be8c52368a615087ef

  • SSDEEP

    3072:Tdbmn8aAEHqgSkano1DTAc5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDT95hWTGHIM/9ldmpwTsLS

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

64.188.99.14:4258

Targets

    • Target

      hidakibest.arm7.elf

    • Size

      150KB

    • MD5

      bb84dd89a14db23194164a7169b475a6

    • SHA1

      7cf0f6fa668d8a29a1005169f9283d416a39a219

    • SHA256

      d2f903112e15d99363654193db43242e9bc3364b434490fdb8d4e5d4d0d3edaf

    • SHA512

      7df1000ae468624f59c9c4a57b8d7eee037e49533d243bc26660fdaf7139df81bed84b3e0bc69a47138998249983c330c50b9f876d7f16be8c52368a615087ef

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAc5hWTGHJWM/9lxXmpwTsL/QMyn:he8aAEHKkdDT95hWTGHIM/9ldmpwTsLS

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks