General

  • Target
    adfd82682720153deaf4016646e10ff4_JaffaCakes118
  • Size 28KB
  • Sample240615-mg3lmaxbra
  • SHA256 91ee347a4a272d947faba623570bc9c23963d0d2eed0011cd62af856b9800f22
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Targets

    • Target
      adfd82682720153deaf4016646e10ff4_JaffaCakes118
    • Size 28KB
    • SHA256 91ee347a4a272d947faba623570bc9c23963d0d2eed0011cd62af856b9800f22
    • MD5 SHA1 SHA512 SSDEEP
    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Flushes firewall rules

      Flushes/ disables firewall rules inside the Linux kernel.

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Disables AppArmor

      Disables AppArmor security module.

    • Disables SELinux

      Disables SELinux security module.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks