General

  • Target

    hidakibest.mips.elf

  • Size

    141KB

  • Sample

    250225-wwx45azqz5

  • MD5

    faf748a382c235db1eeb23891093774c

  • SHA1

    6a12a2ef715f574aba092c87f16b836d49e79492

  • SHA256

    b7b3ad4fa320cbf7a44d5e7bffde713b87bb37555e1dc7512d8b94a0f1273580

  • SHA512

    bf53b643f7e6414d2f7bd1d0ae2a6b7c4cc520f69a8c122ff4c1a25ca3f436fd0c8baa3e846cd23451eb80c2b9c1c28ceb22114255112138a55d7c2110bcb790

  • SSDEEP

    3072:sGGNZfCos2pA4FCk5hvikTam0/5ApYADn:hACyK40k5hvi9m0/5ASADn

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

95.164.52.33:4258

Targets

    • Target

      hidakibest.mips.elf

    • Size

      141KB

    • MD5

      faf748a382c235db1eeb23891093774c

    • SHA1

      6a12a2ef715f574aba092c87f16b836d49e79492

    • SHA256

      b7b3ad4fa320cbf7a44d5e7bffde713b87bb37555e1dc7512d8b94a0f1273580

    • SHA512

      bf53b643f7e6414d2f7bd1d0ae2a6b7c4cc520f69a8c122ff4c1a25ca3f436fd0c8baa3e846cd23451eb80c2b9c1c28ceb22114255112138a55d7c2110bcb790

    • SSDEEP

      3072:sGGNZfCos2pA4FCk5hvikTam0/5ApYADn:hACyK40k5hvi9m0/5ASADn

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks