General
- Target 16201498086.zip
- Size 2.0MB
- Sample240325-qdebeagf98
- SHA256 a7c9f67a881aabc9f37b62bb44887abb5f1b27bb9345005de606885ef38b5a12
Score
10/10
Malware Config
Targets
-
- Target 55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567
- Size 4.7MB
- SHA256 55845e687ddcd2c133d6e30802be2dcc54f27fb8abb894229f76b0767ce56567
Score9/10-
Renames multiple (43000) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes journal logs
Deletes systemd journal logs. Likely to evade detection.
-
Modifies Polkit authorization policy
Modifies rule/ action files in Polkit, possibly to grant additional privileges.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Reads network interface configuration
Fetches information about one or more active network interfaces.
-
Write file to user bin folder
-
Writes file to system bin folder