General

  • Target

    hidakibest.arm6.elf

  • Size

    150KB

  • Sample

    250228-x3pa8svvaw

  • MD5

    87675c50a15812f023768f0d793a310f

  • SHA1

    774030842382cb038317b2cc0e02474c647167a6

  • SHA256

    0aa284e27fcbed6533d8a21428c37dd4bef9bc8d2800df4811f6c27f3bbac010

  • SHA512

    871f46cd9290428510f6ccec3db93ddd1dd98132eace7a6a7554e8d31b346bbdf282079f669d4fa1956843a5eaed2232a93e9255d930896823b1110d0c6a9f28

  • SSDEEP

    3072:Tdbmn8aAEHqgSkano1DTAE5hWTGZWYxVlxXmpwTsL/QMyn:he8aAEHKkdDTZ5hWTGZWYxVldmpwTsLS

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

45.87.246.149:4258

Targets

    • Target

      hidakibest.arm6.elf

    • Size

      150KB

    • MD5

      87675c50a15812f023768f0d793a310f

    • SHA1

      774030842382cb038317b2cc0e02474c647167a6

    • SHA256

      0aa284e27fcbed6533d8a21428c37dd4bef9bc8d2800df4811f6c27f3bbac010

    • SHA512

      871f46cd9290428510f6ccec3db93ddd1dd98132eace7a6a7554e8d31b346bbdf282079f669d4fa1956843a5eaed2232a93e9255d930896823b1110d0c6a9f28

    • SSDEEP

      3072:Tdbmn8aAEHqgSkano1DTAE5hWTGZWYxVlxXmpwTsL/QMyn:he8aAEHKkdDTZ5hWTGZWYxVldmpwTsLS

    Score
    6/10
    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks