rotajakiro | c9924e90d80c2ff46e065a6529df69ac5c0a51012f019e289f6718e83696b535

General

Target
260325-ldk2qshy5q.bin
Size 287KB
Sample260424-jd8fxscw7k
SHA256 c9924e90d80c2ff46e065a6529df69ac5c0a51012f019e289f6718e83696b535
MD5 bcf40ddfd6ab14af8b5ceac9eb1c130d
SHA1 91c120276f4030bfa781a6f02af845f5b441e7fb
SHA512 39392f20ddda670dbf21ec57503927aa23dcc5bf9d6355113998bf1448e208cc4db68bad860257145087e0c506cfbf37a5811eeb52e125dc7cb21b1122083614
SSDEEP 6144:cgi3xrkf593nDI8pglLhWZ+9eD+ek9uXhrlGmek9uXhrlzRQN:9Krkh93DIyLZpD+B9uxsmB9uxzQN
TLSH
T1895423482E9E0EADD1A7A1CB4FFDEEA2343258B23BF895524117345B2BB12D7C140763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0958e1f4c3d14e4de380bda4c5648ab4fa4459ef8f5daaf32bb5f3420217af32
- Size 130KB
- SHA256 0958e1f4c3d14e4de380bda4c5648ab4fa4459ef8f5daaf32bb5f3420217af32
- MD5 11ad1e9b74b144d564825d65d7fb37d6
- SHA1 184355d786a021e0b7297ec20b339be0fac944df
- SHA512 7d84ca944ffee96949fc36a097a641dcf4cf138808ae4e5909fe45581544ad2e0b415655c065f1cb2f9cbabfe7289962b687950c034072a0b6b1a32d290918b0
- SSDEEP 1536:TRDyAvXJNjx76lOjrMtrUgwNfFlcuZwSNHZifLM4LBIIOy3AnToIfNvAJ7x3:TRDyAPJN9rrMINlcG7NZiTMhyETBfNY
- TLSH
  T15CD37C07FADA09FEC0B2C5305AEB81296635BC9123156E3B7588A7713B1BE113B1C7E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt32 ocean_lotus apt backdoor discovery rotajakiro persistence privilege_escalation ransomware
- Detects RotaJakiro Payload
  backdoor apt apt32 ocean_lotus
- Family: RotaJakiro
  RotaJakiro is a Linux-based backdoor attributed to APT32.
  backdoor apt32 rotajakiro
- Renames multiple (1141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
behavioral1
- Target
  a18bec90b2b6185362eeb67c516c82dd34cd8f6a7423875921572e97ae1668b0
- Size 130KB
- SHA256 a18bec90b2b6185362eeb67c516c82dd34cd8f6a7423875921572e97ae1668b0
- MD5 1d45cd2c1283f927940c099b8fab593b
- SHA1 7c6665aaba3b7da391ca8a6dd152bd32fafbad88
- SHA512 1f105a360deea7beb573e98ede194b2a72426187f3c2de4eb921fa922e6ab8a15d2cacdb2e59ae6f0ca995782e679f23d75c826dfb3f77aae1901693d376d52a
- SSDEEP 1536:jWRDyAvXJNjx76lOjrMtrUgwNfFlcuZwSNHZifLM4LBIIOy3AnToIfNvA/:KRDyAPJN9rrMINlcG7NZiTMhyETBfN
- TLSH
  T112D37B07FADA09FEC0B2C5345AEB8129A635BC9113152E3B7588A7713B1BE113B1C7E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt32 ocean_lotus apt backdoor discovery rotajakiro persistence privilege_escalation ransomware
- Detects RotaJakiro Payload
  backdoor apt apt32 ocean_lotus
- Family: RotaJakiro
  RotaJakiro is a Linux-based backdoor attributed to APT32.
  backdoor apt32 rotajakiro
- Renames multiple (1141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
behavioral2
- Target
  af2a2be20d7bbec0a9bb4a4dfa898aa18ef4994a9791d7cf37b7b62b379992ac
- Size 127KB
- SHA256 af2a2be20d7bbec0a9bb4a4dfa898aa18ef4994a9791d7cf37b7b62b379992ac
- MD5 64f6cfe44ba08b0babdd3904233c4857
- SHA1 9a055755d34631b5800729582f3febb4ddecb6d5
- SHA512 ed53230a38049343e74e56e8f47c5cd6395d12efd65bfe255ba0715a10a8271bd0a55c1fb673abc2b43e671975c6d2b27b525fccd22927e0f049c5891de3ad90
- SSDEEP 1536:WRDyAvXJNjx76lOjrMtrUgwNfFlcuZwSNHZifLM4LBIIOy3AnToIfNvAH:WRDyAPJN9rrMINlcG7NZiTMhyETBfNu
- TLSH
  T146D37A07FAAA09FEC0B2C5305AEB8129A6367C9113156E3F7588A771371BE113B1C7E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt32 ocean_lotus apt backdoor discovery rotajakiro persistence privilege_escalation ransomware
- Detects RotaJakiro Payload
  backdoor apt apt32 ocean_lotus
- Family: RotaJakiro
  RotaJakiro is a Linux-based backdoor attributed to APT32.
  backdoor apt32 rotajakiro
- Renames multiple (1141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
behavioral3
- Target
  d38e8f113c36cfa9e05c4d0d6b526d81b69039430c3b1fc64a08a3445b5a5abe
- Size 127KB
- SHA256 d38e8f113c36cfa9e05c4d0d6b526d81b69039430c3b1fc64a08a3445b5a5abe
- MD5 5c0f375e92f551e8f2321b141c15c48f
- SHA1 5fd40cbdcd05e03af7af80d94460924294abd09b
- SHA512 5ba240593229a9c9dbfe09f59ae12585603d02e8738b28b8cf9e9fd869eddfc5b7fe95767144d95a92bf7d03c307dbbd04c67ff1583618633cab7ee3637db919
- SSDEEP 1536:WRDyAvXJNjx76lOjrMtrUgwNfFlcuZwSNHZifLM4LBIIOy3AnToIfNvA:WRDyAPJN9rrMINlcG7NZiTMhyETBfN
- TLSH
  T1D5D37A07FAAA09FEC0B2C4345AEB8129A6367C9113156E3F7588A771371BE113B1C7E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt32 ocean_lotus apt backdoor discovery rotajakiro persistence privilege_escalation ransomware
- Detects RotaJakiro Payload
  backdoor apt apt32 ocean_lotus
- Family: RotaJakiro
  RotaJakiro is a Linux-based backdoor attributed to APT32.
  backdoor apt32 rotajakiro
- Renames multiple (1141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
behavioral4