Analysis
-
max time kernel
149s -
max time network
145s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
31-03-2024 17:55
Behavioral task
behavioral1
Sample
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118
Resource
ubuntu2004-amd64-20240221-en
ubuntu-20.04-amd64
7 signatures
150 seconds
General
-
Target
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118
-
Size
3.3MB
-
MD5
5a0de9b00207bd80ace93be85b21e73e
-
SHA1
9da9876038c054538a2abf7c7c9ad4f79ebdba1a
-
SHA256
fabfb91bec618ce6fc7d83331e6d01ff3256ef60e11a76dd3a7306442fb22f80
-
SHA512
6634a928458018338fdbadb0c6bc84b7b956e216d22dd0527ae47e9977397524d606307ecc71d2b7d8d7960a6dee1c6fbbaa779a026213ef9dbf4416c3e0e52e
-
SSDEEP
98304:XIRNDKBsGftYZlYk1W1lOOOOOOOOOOexrYAUK4ZNhfYqo5ovZxo/379YxnRmQ/bQ:nftYTjE0F88dtN
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118description ioc Process File opened for reading /proc/cpuinfo 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
Processes:
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118description ioc Process File opened for reading /sys/devices/virtual/dmi/id/sys_vendor 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/product_name 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/board_vendor 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/bios_vendor 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 -
Reads CPU attributes 1 TTPs 2 IoCs
Processes:
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118description ioc Process File opened for reading /sys/devices/system/cpu/online 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/system/cpu/possible 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
Processes:
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_uuid 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/bios_date 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/product_version 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/board_serial 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/chassis_type 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/product_serial 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/board_version 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/bios_version 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/board_name 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/chassis_version 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/virtual/dmi/id/chassis_serial 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 -
Enumerates kernel/hardware configuration 1 TTPs 54 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118description ioc Process File opened for reading /sys/bus/dax/devices 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/dax/devices/target_node 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/node/devices/node0/access0/initiators 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_cpus 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/cpu/devices/cpu0/topology/package_cpus 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/dax/target_node 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/level 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/bus/node/devices/node0/cpumap 5a0de9b00207bd80ace93be85b21e73e_JaffaCakes118 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages