Overview

overview

10

Static

static

10

JaffaCakes...628c5d

debian-12-armhf

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ade00f4394a2e63d79de0d3e77628c5d

  • Size

    167KB

  • Sample

    250105-s2chtsyjev

  • MD5

    ade00f4394a2e63d79de0d3e77628c5d

  • SHA1

    b897fbf235867379a028f26b81911836db27a2c0

  • SHA256

    717621ec6ce942aa60ea8a69010d094ceaf73b3b8f4967e901d374d56eefc7ce

  • SHA512

    4724de9bc2385e7d37fc548443a5fa78000f0853a256c02cd9b4eb2e8a4555f4c96db8c4858f8d16efe2e2af74599e4e3b339cebc7ab40c448025fa5ffce4960

  • SSDEEP

    3072:5zGFjXsW6JDBQastL+2yAAf6p5j4pUCGCQLv7mKGTIycohM/9EZFAD8b2:xoXsWU2BD4pUCGfLzmKrycGM/9qJ2

Score
10/10
mirairedlinecredential_accessdefense_evasiondiscoveryexecutioninfostealer

Malware Config

Targets

    • Target

      JaffaCakes118_ade00f4394a2e63d79de0d3e77628c5d

    • Size

      167KB

    • MD5

      ade00f4394a2e63d79de0d3e77628c5d

    • SHA1

      b897fbf235867379a028f26b81911836db27a2c0

    • SHA256

      717621ec6ce942aa60ea8a69010d094ceaf73b3b8f4967e901d374d56eefc7ce

    • SHA512

      4724de9bc2385e7d37fc548443a5fa78000f0853a256c02cd9b4eb2e8a4555f4c96db8c4858f8d16efe2e2af74599e4e3b339cebc7ab40c448025fa5ffce4960

    • SSDEEP

      3072:5zGFjXsW6JDBQastL+2yAAf6p5j4pUCGCQLv7mKGTIycohM/9EZFAD8b2:xoXsWU2BD4pUCGfLzmKrycGM/9qJ2

    Score
    10/10
    redlinecredential_accessdefense_evasiondiscoveryexecutioninfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Redline family

      redline

    • Contacts a large (135874) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

      credential_access
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks