General
- Target adfd82682720153deaf4016646e10ff4_JaffaCakes118
- Size 28KB
- Sample240615-mg3lmaxbra
- SHA256 91ee347a4a272d947faba623570bc9c23963d0d2eed0011cd62af856b9800f22
- MD5 adfd82682720153deaf4016646e10ff4
- SHA1 ca692f655cb6bc8cbdc7ac816b4554d851beaeaf
- SHA512 2411c51fa4e7af9d5a4ed6ef3121da1885f0f23239eacd59102e55c1974c12cc3f7b6748af30aa79ec686e972614000da626708045e42ef784f3a9a17336d3c6
- SSDEEP 384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeq:p7JVFNcD8FLcIwgiYq0xFBt65
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
adfd82682720153deaf4016646e10ff4_JaffaCakes118
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
adfd82682720153deaf4016646e10ff4_JaffaCakes118
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
adfd82682720153deaf4016646e10ff4_JaffaCakes118
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
adfd82682720153deaf4016646e10ff4_JaffaCakes118
Resource
debian9-mipsel-20240611-en
Malware Config
Targets
-
- Target adfd82682720153deaf4016646e10ff4_JaffaCakes118
- Size 28KB
- SHA256 91ee347a4a272d947faba623570bc9c23963d0d2eed0011cd62af856b9800f22
- MD5 adfd82682720153deaf4016646e10ff4
- SHA1 ca692f655cb6bc8cbdc7ac816b4554d851beaeaf
- SHA512 2411c51fa4e7af9d5a4ed6ef3121da1885f0f23239eacd59102e55c1974c12cc3f7b6748af30aa79ec686e972614000da626708045e42ef784f3a9a17336d3c6
- SSDEEP 384:p7pQQwQHDf6jlpTWg3vMGQiKMvU/4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdeq:p7JVFNcD8FLcIwgiYq0xFBt65
- MD5 SHA1 SHA512 SSDEEP
Score10/10Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
Flushes firewall rules
Flushes/ disables firewall rules inside the Linux kernel.
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
Disables AppArmor
Disables AppArmor security module.
Disables SELinux
Disables SELinux security module.
Enumerates running processes
Discovers information about currently running processes on the system
Legitimate hosting services abused for malware hosting/C2