Analysis
-
max time kernel
142s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30/03/2024, 20:38
Behavioral task
behavioral1
Sample
43c05c621f95d5d00004aa2ff44488c1_JaffaCakes118
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
43c05c621f95d5d00004aa2ff44488c1_JaffaCakes118
-
Size
113KB
-
MD5
43c05c621f95d5d00004aa2ff44488c1
-
SHA1
94631025f50da620fcca8a842216ee19bb7158dd
-
SHA256
e4006f22c75548cc4765a252e793af3654afc92744a1602427b8cf72129be0cf
-
SHA512
c2916edb4d3561bc44be107e04b049ea7ee11fecbca64d82c58e188b2df0d7a8efa6e5f1d0ad0b047d4761b8795e8a9c6c9d4d15d11048f73c5c3a6122a420f5
-
SSDEEP
3072:kiry859a2ADJf9wHYqbgFFo8+HeAB+T1bm7FnVqfJXoebNb:T9a2aLqkrMcBm7FnVqfJXoebNb
Malware Config
Signatures
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 1546 43c05c621f95d5d00004aa2ff44488c1_JaffaCakes118 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 43c05c621f95d5d00004aa2ff44488c1_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route 43c05c621f95d5d00004aa2ff44488c1_JaffaCakes118