General
- Target 30073830161495e8a96f8f18060489fa_JaffaCakes118
- Size 3.2MB
- Sample240510-t2a6fafa2w
- SHA256 d3e28602a558f2e16407b9d18602d1add9427a139fdf0100d01898d523b8fdde
Score
8/10
Malware Config
Targets
-
- Target 30073830161495e8a96f8f18060489fa_JaffaCakes118
- Size 3.2MB
- SHA256 d3e28602a558f2e16407b9d18602d1add9427a139fdf0100d01898d523b8fdde
Score8/10-
Adds new SSH keys
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Reads list of loaded kernel modules
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Write file to user bin folder