Extracted

• • Target
    e751f04ca10540e0519521f2f5081542_JaffaCakes118
  • Size 4.2MB
  • SHA256 357acbacdb9069b8484f4fdead1aa946e2eb4a505583058f91f40903569fe3f3
  • MD5 e751f04ca10540e0519521f2f5081542
  • SHA1 582872b90ca882437e0a52680c911cb07fe3f781
  • SHA512 7fc6776ca1092b001ca909b87446a839fa6d1d6a5a28e28b193531f353df122639de2431e6478f9e4d662232bdff970b49a029981e6689b93b5e35a02752a923
  • SSDEEP 49152:L2MvK3tNmi1FwXoZQCdKcmNpWGEZvfGjU:L2MmpDwYhdK7lEb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatioprivilege_escalation

  • Kaiji

    Kaiji payload

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies systemd

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1