465b70e021acdc1da63fd940d99dc1849c62842855e9b056c01bef13d845c8fc

Sharing

Copy URL Twitter E-mail

General

Target
9fd01f74bb5e0f2d2e64dc896e35bc62_JaffaCakes118
Size 19.9MB
Sample240611-2tlk7svfle
SHA256 465b70e021acdc1da63fd940d99dc1849c62842855e9b056c01bef13d845c8fc
MD5 9fd01f74bb5e0f2d2e64dc896e35bc62
SHA1 0d03198787b79ad12e8079f48c16a71152cf42ad
SHA512 0e3dee9f546ea05184c3dd267473b583da5c67f9a7af738db30c9ae350aacaa45126554ed344d8ac1eb2369890adb50f461ebfbcaccd7887aa41a41017da37dd
SSDEEP 196608:ErYAlZ2rxsCrtb5MohSMrNR5u7b6LoBwG476i3C/Mcjo1E8NrL4A0kOa51hwZpHv:wSk74c4aQD13uz+
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

linux persistence

Malware Config

Targets

- Target
  sniff/.etc.ssh/ssh/ssh_host_dsa_key.pub
- Size 590B
- SHA256 4847441bc42ea4be9024e63fa8a629787b8ede6d2ed62595620e011996337841
- MD5 b0b5c85d6e80d95bbd2223a034d83a54
- SHA1 bb1d1454938e2c086c2006fbaf149dcac4efe778
- SHA512 955148450a28bb3e8972290b1b4be013ebfcd756b7dc233f99632f055f0821748e20911f51cb13f124747a2f0f17026b7d5ce73da3da85e9b9d2f769d6394408
- MD5 SHA1 SHA512
Score

4^/10
behavioral1 behavioral2
- Target
  sniff/.etc.ssh/ssh/ssh_host_key.pub
- Size 645B
- SHA256 6995b149347983ba76efab85d26d9361e627cb5a22da3c404a38ddf40f30a3d9
- MD5 28d89da0288323ec25bd1f9b9d3d16b9
- SHA1 a813f27447e3a5a0e70777d6a89ef6eaf7c8576c
- SHA512 c6229c4651797147aee46cfe20e9dbc18db5c4f3aa7731a21abf4c8e4432a5ea247e1212510490f24fe6f5099e55bb86f8f513747dec5e7c9fd94b3d533196e5
- MD5 SHA1 SHA512
Score

4^/10
behavioral3 behavioral4
- Target
  sniff/.etc.ssh/ssh/ssh_host_rsa_key.pub
- Size 382B
- SHA256 f0642d039e4a9483e663f9c5d213862767777afebdb5a690edf50afa6aeded99
- MD5 530106c394b7b6d17e6638ba28ffc360
- SHA1 f551a351f54e9dc85f49e4a674035da2b1f14ce7
- SHA512 856845f7caf85600662a10aa01604cb6ec09fd44d80a06ea68cc2830731ab8b4fff8fc7e85f0cec667663a88ec0d1ad322504c6f560fa06376775409490e39c3
- MD5 SHA1 SHA512
Score

4^/10
behavioral5 behavioral6
- Target
  sniff/.etc.ssh/ssh_host_dsa_key.pub
- Size 590B
- SHA256 4847441bc42ea4be9024e63fa8a629787b8ede6d2ed62595620e011996337841
- MD5 b0b5c85d6e80d95bbd2223a034d83a54
- SHA1 bb1d1454938e2c086c2006fbaf149dcac4efe778
- SHA512 955148450a28bb3e8972290b1b4be013ebfcd756b7dc233f99632f055f0821748e20911f51cb13f124747a2f0f17026b7d5ce73da3da85e9b9d2f769d6394408
- MD5 SHA1 SHA512
Score

4^/10
behavioral7 behavioral8
- Target
  sniff/.etc.ssh/ssh_host_key.pub
- Size 645B
- SHA256 6995b149347983ba76efab85d26d9361e627cb5a22da3c404a38ddf40f30a3d9
- MD5 28d89da0288323ec25bd1f9b9d3d16b9
- SHA1 a813f27447e3a5a0e70777d6a89ef6eaf7c8576c
- SHA512 c6229c4651797147aee46cfe20e9dbc18db5c4f3aa7731a21abf4c8e4432a5ea247e1212510490f24fe6f5099e55bb86f8f513747dec5e7c9fd94b3d533196e5
- MD5 SHA1 SHA512
Score

4^/10
behavioral10 behavioral9
- Target
  sniff/.etc.ssh/ssh_host_rsa_key.pub
- Size 382B
- SHA256 f0642d039e4a9483e663f9c5d213862767777afebdb5a690edf50afa6aeded99
- MD5 530106c394b7b6d17e6638ba28ffc360
- SHA1 f551a351f54e9dc85f49e4a674035da2b1f14ce7
- SHA512 856845f7caf85600662a10aa01604cb6ec09fd44d80a06ea68cc2830731ab8b4fff8fc7e85f0cec667663a88ec0d1ad322504c6f560fa06376775409490e39c3
- MD5 SHA1 SHA512
Score

4^/10
behavioral11 behavioral12
- Target
  sniff/.g/ln.sh
- Size 417B
- SHA256 267e645cc707c78039866cd189feb8c2854136e01d98065b65cef39874ac108d
- MD5 50087575bb4fb7dfa44032857f73be14
- SHA1 26435414419711b23639500c4ee0ff923fc63117
- SHA512 db01849f07f3197c76f9c37bccb1e347516fa19142b0a7f8ef006cc4b5f726f9ab497921ad656d4fbd0be67e3ee5dcc8423a174cc9fa07486de20f91087f6281
- MD5 SHA1 SHA512
Score

3^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  sniff/.g/max.sh
- Size 1KB
- SHA256 7982564b8f651cc5bc2aa0f74aaeda9c6f2ddaf2c6f6d56c80a7660b169c2688
- MD5 585fbcdac59b609c99a7e754e9312c2e
- SHA1 7dabd278f466ae65a10070a1782e399b30533b36
- SHA512 187292192934b1bf8ec650f3f0e1f20696b0a2f9484f0b4a38cb662e12461fbe9d63f8c1c2e55fe81df6448778283d6f4b74c17d3d6c16ae2263f13b7e5ba8cd
- MD5 SHA1 SHA512
Score

6^/10

persistence
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  persistence
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  sniff/.g/x64
- Size 7KB
- SHA256 2da3c9788c6121d2703775f864b1734b5a080724bf200b2b1f39a6e2350786fc
- MD5 fee86f61f6e606bcaca25afc24bc2d55
- SHA1 42f049a28156c0bb0a35eab5b3c01b23afc27fb9
- SHA512 0181fb7f6b6e994a4784dbd1b6e3e206b78b61d93107b8d07ef421027b05cef4d5177e47bec84894fb03ba1882744d16170e1d4b2ddcde54c816e889edb6843f
- SSDEEP 96:RrVFs/EkSR+1KLc5lTdDhq+s7IUnVkGQIKVqH+t4ho:RBW/EkYY5lTdiYqH+tSo
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  sniff/.g/x86.sh
- Size 18KB
- SHA256 68027452a63261bc0c663917a67349d3ba89b639696c0ef86f34f207f8b8d8b0
- MD5 e378f342726722c04f659c464444d876
- SHA1 90df39d4a31214fa1e82efd673075488f60a1f61
- SHA512 631c51c2423047af0c0fd0bc2beba5cdeae178050ae87a0c4ac89146e96cb64722a6dc64557dce4b5d249c42934f78aa773a16fb14bcf52d735fe6902dd9c2f4
- SSDEEP 384:fi6uMdEEHV+rFednYMCQ7UfBXh18I74dOPtpiYbs5BHsiM:rqoU8a9Q7UVP37JTs5BMF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  sniff/.g/xcron/sh64
- Size 8KB
- SHA256 a64ed24fefe2b38f6785b2f4702bac709b4e2ea3c4b9bd3292c5c8de264d3f13
- MD5 625bdfb6f5c5b892644e65b9274d8426
- SHA1 d9564e89a8192e94c3c07ae53986e65ed2e5819b
- SHA512 3dc8f88aafc3d2499bfa3222a12216064adf343264e31543677d2336e81e4198863732182022d6dd6ab5b0980a0d579ff4fbcfd589a2ec1f481849b0eee7ca78
- SSDEEP 96:GITtiupr7mGnGngOOiO30HlSRyq4hl252IzS+1e7QVNytOjdRFp:GIRJrq9nFOxQlCyqb07CEtObz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  sniff/.g/xcron/sh86
- Size 6KB
- SHA256 4426c786f3eed0a31c8aef95daf93fafb45c7ce09ae88963880c057d17b29f4c
- MD5 fd89116cceb63e416b1db5d94819fdb1
- SHA1 fda6da45a3d4a93f93a4c769c42a640ec1bb94a3
- SHA512 13a08aa1618152332505053e49117732be468fd139bfa21e83bbabc818438095438e89c654b604c6e5ee0cf3786b1a4b6773c3d6284874150db9f34b44813597
- SSDEEP 96:fDLpmPL0qltgZ8630hvDTUL9XLhtjJxODTPKns/aAZNUQGyNhzeFH:foPts86+LQxv9CfNYR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  sniff/.g/xcron/xcron.sh
- Size 638B
- SHA256 3d5f7b7407c00a564ab6104eed6e60d2dfd86776b4de6aee9717c0208e7b4c7a
- MD5 efc81dfd035c660ea9327b18ef408d0a
- SHA1 d88057cbc43b2e3976ec58b724f09c28283293cb
- SHA512 ab30f78e14eb1e5a07669dad233ea961694aef490c3dd5538c9f818c48bff42c06af2d2cee40e225fdb2a516d4a479131db30fab0919da8b3a18682e32207ac9
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  sniff/03jf.txt
- Size 5KB
- SHA256 c0f53a3879a8c2e7576d9c8164ba9fdaf7fdee832ff7fab4c44645dc4572840c
- MD5 4fa2fe1dac167bbd093ca47e65e944ca
- SHA1 cbf5dcc534b6bd058f34a00a2d8ba9ff1d79561f
- SHA512 83e34f6eac3c80e4ace5158344c5d1f30989df19ea73f44f0bce5f002c41f239c5f30a39552e2e62d31faf6df9b5a6cc94a9d64b48f5dd805523a6baa4c36691
- SSDEEP 96:v4EzyPyXkK+OygOkq+42lfe9ePCect1Nutq/6MsAMsEvvpMsAMsEZ:liuKkjitAMaFv6ab
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Creates/modifies Cron job

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32