Overview

overview

7

Static

static

1

ff983fced3...kes118

ubuntu-18.04-amd64

7

ff983fced3...kes118

debian-9-armhf

ff983fced3...kes118

debian-9-mips

7

ff983fced3...kes118

debian-9-mipsel

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff983fced3f7e17fbc6577f1de795597_JaffaCakes118

  • Size

    30KB

  • Sample

    240421-sw659aef4z

  • MD5

    ff983fced3f7e17fbc6577f1de795597

  • SHA1

    1e2056f1a1e1981b0f37b576e5aa443846c503b9

  • SHA256

    56ac2321e481708ea72e2bf7710e66c3455afa729b24f6a6ba9065ae0cca8fb3

  • SHA512

    b904d6721c2658ab7a683520c9471ce1393a601eba8c945f580848dcccdf82dbea469dfb8394a05d97d52611316b0848ac7a8974f693582207ff0f57a5bc8b93

  • SSDEEP

    768:p7fzQ5VFNcDAFLcIwgnoYq0xFBVdHti5N:0VF+D6cIwgoszGN

Score
7/10
evasionlinuxpersistencerootkit

Malware Config

Targets

    • Target

      ff983fced3f7e17fbc6577f1de795597_JaffaCakes118

    • Size

      30KB

    • MD5

      ff983fced3f7e17fbc6577f1de795597

    • SHA1

      1e2056f1a1e1981b0f37b576e5aa443846c503b9

    • SHA256

      56ac2321e481708ea72e2bf7710e66c3455afa729b24f6a6ba9065ae0cca8fb3

    • SHA512

      b904d6721c2658ab7a683520c9471ce1393a601eba8c945f580848dcccdf82dbea469dfb8394a05d97d52611316b0848ac7a8974f693582207ff0f57a5bc8b93

    • SSDEEP

      768:p7fzQ5VFNcDAFLcIwgnoYq0xFBVdHti5N:0VF+D6cIwgoszGN

    Score
    7/10
    evasionpersistencerootkit

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

      evasion

    • Flushes firewall rules

      Flushes/ disables firewall rules inside the Linux kernel.

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Disables AppArmor

      Disables AppArmor security module.

    • Disables SELinux

      Disables SELinux security module.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks