General

  • Target

    84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118

  • Size

    35KB

  • Sample

    240810-fq3jnaxbkr

  • MD5

    84e5ee91b2eecfb946ff935cd8ff5e80

  • SHA1

    f7cb4120aacc2fc85e7eb655cc2d8fc4d40e59e6

  • SHA256

    1b0be209ed0d4918c70b84427667f164f40d90efc2998553cd08f2219d2e6f04

  • SHA512

    8b918c0e9c8c42018df31da1eef062215ef6ff4f12046e5ca987aa1e0df7a8a85bad8e5db8cfef4b6fdbfab7be470e250e4bc5845e77b9f0422b6aef966f9485

  • SSDEEP

    384:zQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIDbv:TFNB48Fkc2zq0xvcGGIr9L8eT

Malware Config

Targets

    • Target

      84e5ee91b2eecfb946ff935cd8ff5e80_JaffaCakes118

    • Size

      35KB

    • MD5

      84e5ee91b2eecfb946ff935cd8ff5e80

    • SHA1

      f7cb4120aacc2fc85e7eb655cc2d8fc4d40e59e6

    • SHA256

      1b0be209ed0d4918c70b84427667f164f40d90efc2998553cd08f2219d2e6f04

    • SHA512

      8b918c0e9c8c42018df31da1eef062215ef6ff4f12046e5ca987aa1e0df7a8a85bad8e5db8cfef4b6fdbfab7be470e250e4bc5845e77b9f0422b6aef966f9485

    • SSDEEP

      384:zQQwQHDf6lpTWg3vM4Qdre21jT58vKpG2Y0orcfKLUv0KZnNEVdUeUoJpJydIDbv:TFNB48Fkc2zq0xvcGGIr9L8eT

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Adds new SSH keys

      Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    • Flushes firewall rules

      Flushes/ disables firewall rules inside the Linux kernel.

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Disables AppArmor

      Disables AppArmor security module.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Writes file to system bin folder

MITRE ATT&CK Enterprise v15

Tasks