General
-
Target
fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
-
Size
30KB
-
Sample
240927-qwvfcaxdma
-
MD5
fa8008ca091d7d984279655e9bc577d8
-
SHA1
2cb21f9e3473a1fb6e3718b2018d6eea5f6f5020
-
SHA256
3c0e677024ea8554a0eed96c62ef39549cefebb44937d9c778926daac67d5495
-
SHA512
138f3847581ed8730764453da36c9555dd669e0bf5efc0c6f2433d443afeb4419cd6f190d97417dfa47a8cde3ab145e75664e96b16aad991ab5f10bf8204d9db
-
SSDEEP
384:p7pQBDf6jlpTWg3vMGQiirhHwMyGj4CC9vEKMvU/4Qdre21jT58vKpG2Y0orcfKS:p78zQ5VFNcDAFLcIwgnoYq0xFBVZHttn
Static task
static1
Behavioral task
behavioral1
Sample
fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
Resource
debian9-mipsel-20240226-en
Malware Config
Targets
-
-
Target
fa8008ca091d7d984279655e9bc577d8_JaffaCakes118
-
Size
30KB
-
MD5
fa8008ca091d7d984279655e9bc577d8
-
SHA1
2cb21f9e3473a1fb6e3718b2018d6eea5f6f5020
-
SHA256
3c0e677024ea8554a0eed96c62ef39549cefebb44937d9c778926daac67d5495
-
SHA512
138f3847581ed8730764453da36c9555dd669e0bf5efc0c6f2433d443afeb4419cd6f190d97417dfa47a8cde3ab145e75664e96b16aad991ab5f10bf8204d9db
-
SSDEEP
384:p7pQBDf6jlpTWg3vMGQiirhHwMyGj4CC9vEKMvU/4Qdre21jT58vKpG2Y0orcfKS:p78zQ5VFNcDAFLcIwgnoYq0xFBVZHttn
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Disables AppArmor
Disables AppArmor security module.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
1Clear Linux or Mac System Logs
1