General
-
Target
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
-
Size
35KB
-
Sample
240810-fq3jnaxbkr
-
MD5
84e5ee91b2eecfb946ff935cd8ff5e80
-
SHA1
f7cb4120aacc2fc85e7eb655cc2d8fc4d40e59e6
-
SHA256
1b0be209ed0d4918c70b84427667f164f40d90efc2998553cd08f2219d2e6f04
-
SHA512
8b918c0e9c8c42018df31da1eef062215ef6ff4f12046e5ca987aa1e0df7a8a85bad8e5db8cfef4b6fdbfab7be470e250e4bc5845e77b9f0422b6aef966f9485
-
SSDEEP
384:zQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIDbv:TFNB48Fkc2zq0xvcGGIr9L8eT
Static task
static1
Behavioral task
behavioral1
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
Resource
debian9-mipsel-20240418-en
Malware Config
Targets
-
-
Target
84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118
-
Size
35KB
-
MD5
84e5ee91b2eecfb946ff935cd8ff5e80
-
SHA1
f7cb4120aacc2fc85e7eb655cc2d8fc4d40e59e6
-
SHA256
1b0be209ed0d4918c70b84427667f164f40d90efc2998553cd08f2219d2e6f04
-
SHA512
8b918c0e9c8c42018df31da1eef062215ef6ff4f12046e5ca987aa1e0df7a8a85bad8e5db8cfef4b6fdbfab7be470e250e4bc5845e77b9f0422b6aef966f9485
-
SSDEEP
384:zQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIDbv:TFNB48Fkc2zq0xvcGGIr9L8eT
Score10/10-
Adds new SSH keys
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Flushes firewall rules
Flushes/ disables firewall rules inside the Linux kernel.
-
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Disables AppArmor
Disables AppArmor security module.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder
-