Analysis
-
max time kernel
149s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240226-en -
resource tags
arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
08-04-2024 14:37
General
-
Target
e7b0d11e6f279c3d77f3dd983bac2c22_JaffaCakes118
-
Size
34KB
-
MD5
e7b0d11e6f279c3d77f3dd983bac2c22
-
SHA1
1016840bdd473f52ffd5c38e940e4bec8005a64e
-
SHA256
00ddb6898632b99d0de1899a2f1a0959f41be76536eda7e62b4b528a7354e34a
-
SHA512
3c7b28bb06c98c892e8b791c02cba9e48387ffa422096a5512288a7fef1f395a23fcebf8b152f5dfdb05640e2bec30fc142d5830aff73a30c9dbe485401d306c
-
SSDEEP
768:2G4+o9Yc0S49JJUTg1LFGvZP9a6qmYM1aH1tQKwwfu4Os3Uozi:2v9tsUTgpFGN9a6hhYVCWNzi
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (197485) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
description ioc File opened for reading /proc/net/tcp -
Reads runtime system information 13 IoCs
Reads data from /proc virtual filesystem.
Processes:
e7b0d11e6f279c3d77f3dd983bac2c22_JaffaCakes118description ioc File opened for reading /proc/138/fd File opened for reading /proc/168/fd File opened for reading /proc/283/fd File opened for reading /proc/313/fd File opened for reading /proc/316/fd File opened for reading /proc/326/fd File opened for reading /proc/self/exe e7b0d11e6f279c3d77f3dd983bac2c22_JaffaCakes118 File opened for reading /proc/282/fd File opened for reading /proc/299/fd File opened for reading /proc/279/fd File opened for reading /proc/1/fd File opened for reading /proc/229/fd File opened for reading /proc/300/fd
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/661-1-0x00008000-0x00025a04-memory.dmp