rapperbot | d30e462049d55176bf5909d6ecc39f01bf2a7d946692636ec13af2cb5c221b00

General

Target
jaffacakes118_d30e462049d55176bf5909d6ecc39f01bf2a7d946692636ec13af2cb5c221b00.bin
Size 155KB
Sample260922-ltn4bstanh
SHA256 d30e462049d55176bf5909d6ecc39f01bf2a7d946692636ec13af2cb5c221b00
MD5 d35507be8d711ae4974526ec2d783ec2
SHA1 738f25bce258604e4c21fdf1816ec2239a046a50
SHA512 13a522ca1d8a63a4f17d220ae850141d60d9015fd2616011e499a0122e9beb38454377f5c19bec8c95578b4164c0da027857fb810abd5363767003cf22c700af
SSDEEP 3072:RR4kNUoPMlYu0BZTsAsAjTeC/cpU6nWwTsXF2yY:9NUokBiteKcpU6Wi4LY
TLSH
T102F3F61E6E228FBDF269873587F34A31D35833D623E19245E1BCD1246E7029D281FBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  jaffacakes118_d30e462049d55176bf5909d6ecc39f01bf2a7d946692636ec13af2cb5c221b00.bin
- Size 155KB
- SHA256 d30e462049d55176bf5909d6ecc39f01bf2a7d946692636ec13af2cb5c221b00
- MD5 d35507be8d711ae4974526ec2d783ec2
- SHA1 738f25bce258604e4c21fdf1816ec2239a046a50
- SHA512 13a522ca1d8a63a4f17d220ae850141d60d9015fd2616011e499a0122e9beb38454377f5c19bec8c95578b4164c0da027857fb810abd5363767003cf22c700af
- SSDEEP 3072:RR4kNUoPMlYu0BZTsAsAjTeC/cpU6nWwTsXF2yY:9NUokBiteKcpU6Wi4LY
- TLSH
  T102F3F61E6E228FBDF269873587F34A31D35833D623E19245E1BCD1246E7029D281FBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

antivm command_and_control credential_access defense_evasion discovery execution lateral_movement persistence privilege_escalation
- Contacts a large (323294) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Adds new SSH keys
  Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
  persistence privilege_escalation
- Modifies password files for system users/ groups
  Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
  persistence credential_access defense_evasion
- Outbound SSH connection to private host
  SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.
  command_and_control lateral_movement
- Deletes itself
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Adds a user to the system
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1