Analysis
- max time kernel
145s - max time network
134s - platform
debian-9_armhf - resource
debian9-armhf-20240226-en - resource tags
- submitted
29/03/2024, 16:20
General
- Target 26bf96d8a95dcbc0f5f8317adbac3b4e_JaffaCakes118
- Size 126KB
- Sample240329-tthwbach34
- SHA256 b8fd5494786a392565ffe16d76be6ba6b8c6abbb2a7eae219e7fa67fb2b058e6
Score
7/10
Malware Config
Signatures
- Changes its process name 1 IoCs
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/26bf96d8a95dcbc0f5f8317adbac3b4e_JaffaCakes118/tmp/26bf96d8a95dcbc0f5f8317adbac3b4e_JaffaCakes1181⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration