Overview

overview

10

Static

static

10

1d1a7c789b...kes118

ubuntu-22.04-amd64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    28-07-2024 18:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1d1a7c789bd31b95622e8a907e3d675e_JaffaCakes118

  • Size

    651KB

  • MD5

    1d1a7c789bd31b95622e8a907e3d675e

  • SHA1

    ba1c514964ea1d48705fff9bd5da8d7f4a170e4a

  • SHA256

    ca21a60bf8ffb7414a9e52a2e1574b0f15797e5e32ca196bf093b2cf7c2b0a49

  • SHA512

    3734bf6eaa703f257ba0fc3e08517239dcc8cf79ad1f0a285232044584e573041242319dda1af856f419a5f2518f4655972ac30847db6b580adf5943d15f9d14

  • SSDEEP

    12288:Fw0NVs5pgfZ+iGXUaCngHp0Vs1YkhHBrtsuei3VVy1hZtjB2:F3NVs5pgfZ+iGE3gHfSkhHBrtgUVVyPY

Score
7/10
evasion

Malware Config

Signatures

  • Deletes system logs 1 TTPs 1 IoCs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    evasion
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/1d1a7c789bd31b95622e8a907e3d675e_JaffaCakes118
    /tmp/1d1a7c789bd31b95622e8a907e3d675e_JaffaCakes118
    1⤵
    • Writes file to tmp directory
    PID:1513
    • /bin/sh
      sh -c "rm -rf /var/log/syslog;touch /var/log/syslog;chmod 0000 /var/log/syslog;chattr +isa /var/log/syslog;"
      2⤵
        PID:1514
        • /usr/bin/rm
          rm -rf /var/log/syslog
          3⤵
          • Deletes system logs
          PID:1515
        • /usr/bin/touch
          touch /var/log/syslog
          3⤵
            PID:1516
          • /usr/bin/chmod
            chmod 0000 /var/log/syslog
            3⤵
              PID:1517
            • /usr/bin/chattr
              chattr +isa /var/log/syslog
              3⤵
                PID:1518

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads