General
-
Target
40e52b7bde1eeaa171cbaa04ad814bff_JaffaCakes118
-
Size
28KB
-
Sample
240514-kmyhrahb2t
-
MD5
40e52b7bde1eeaa171cbaa04ad814bff
-
SHA1
983553ee2b3ea8c1716121bab4afe300fb06a786
-
SHA256
c1c395dadb2f9d96ff6aa10d36cf64ec6c432a7f68ad9c50fb3ab4cb99eb78be
-
SHA512
b5ecb9ba9c3360c60c6d3b31ea8bde67510e2457256d1c81e34d97f96851e5b7264433a56d5129a0f72bfb212f97051aaebf5c49fafd7c9fc9da48a842cc261e
-
SSDEEP
384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeu:p7JVFNcD8FLcIwgiYq0xFB85
Static task
static1
Behavioral task
behavioral1
Sample
40e52b7bde1eeaa171cbaa04ad814bff_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
40e52b7bde1eeaa171cbaa04ad814bff_JaffaCakes118
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
40e52b7bde1eeaa171cbaa04ad814bff_JaffaCakes118
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
40e52b7bde1eeaa171cbaa04ad814bff_JaffaCakes118
Resource
debian9-mipsel-20240226-en
Malware Config
Targets
-
-
Target
40e52b7bde1eeaa171cbaa04ad814bff_JaffaCakes118
-
Size
28KB
-
MD5
40e52b7bde1eeaa171cbaa04ad814bff
-
SHA1
983553ee2b3ea8c1716121bab4afe300fb06a786
-
SHA256
c1c395dadb2f9d96ff6aa10d36cf64ec6c432a7f68ad9c50fb3ab4cb99eb78be
-
SHA512
b5ecb9ba9c3360c60c6d3b31ea8bde67510e2457256d1c81e34d97f96851e5b7264433a56d5129a0f72bfb212f97051aaebf5c49fafd7c9fc9da48a842cc261e
-
SSDEEP
384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeu:p7JVFNcD8FLcIwgiYq0xFB85
Score10/10-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Flushes firewall rules
Flushes/ disables firewall rules inside the Linux kernel.
-
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Disables AppArmor
Disables AppArmor security module.
-
Disables SELinux
Disables SELinux security module.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Legitimate hosting services abused for malware hosting/C2
-