Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240226-en -
resource tags
arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
21-04-2024 04:24
General
-
Target
fe6cdf520883efc846ef228f039f57ac_JaffaCakes118
-
Size
31KB
-
MD5
fe6cdf520883efc846ef228f039f57ac
-
SHA1
d94fae6008018b6631ba19c46b4aed37124afea9
-
SHA256
3ba27fc2fb9909393d8049e708461f4f6d488055aa28fe20a12bb73dc18d3ca6
-
SHA512
e17a2d30b86cbd2844dfdd8f710307f8b294e61363cf0b14daac63396ec503368f95ffdc6c8937dc454a50198c2c8b93ac8f6c899f9067626afd791ad48dd2e8
-
SSDEEP
384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfiNtssera3FRWGVCzG:4fpWcehzJFYKgULAssKfi7ua3zW+
Malware Config
Extracted
mirai
LZRD
Signatures
-
Contacts a large (19963) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
fe6cdf520883efc846ef228f039f57ac_JaffaCakes118description ioc process File opened for modification /dev/watchdog fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for modification /dev/misc/watchdog fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
fe6cdf520883efc846ef228f039f57ac_JaffaCakes118description ioc process File opened for reading /proc/net/tcp fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
fe6cdf520883efc846ef228f039f57ac_JaffaCakes118description ioc process File opened for reading /proc/net/tcp fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 -
Reads runtime system information 44 IoCs
Reads data from /proc virtual filesystem.
Processes:
fe6cdf520883efc846ef228f039f57ac_JaffaCakes118description ioc process File opened for reading /proc/789/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/173/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/342/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/388/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/389/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/691/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/717/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/724/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/684/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/691/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/692/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/343/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/685/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/685/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/797/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/148/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/340/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/373/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/725/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/736/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/714/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/724/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/339/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/394/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/681/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/684/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/723/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/442/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/785/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/1/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/253/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/708/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/709/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/719/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/722/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/708/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/711/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/442/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/692/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/712/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/717/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/720/fd fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/681/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118 File opened for reading /proc/715/exe fe6cdf520883efc846ef228f039f57ac_JaffaCakes118
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/716-1-0x00400000-0x00455bd8-memory.dmp