Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240418-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07-05-2024 11:35
General
-
Target
2074091f40149089c239847e2f42e955_JaffaCakes118
-
Size
30KB
-
MD5
2074091f40149089c239847e2f42e955
-
SHA1
c166d48788656bbb8bbc68817fcd998e7b47c581
-
SHA256
45424559126ee4d9b485aecdfadda93a13185f537ae88e07fad152dcad9b1663
-
SHA512
4e49c45429fea24bab2159e187e74f2cf2fd9371ff8c2dbaf095226e5892dfc80b534c615d17544c45991992ae1faac3c9e48de792b5e1301dccb243b4527311
-
SSDEEP
768:0uH5tyEYkO4uhxG6OQhyXKR92q+I1nbcuyD7UHQRjq:RZIEYt4uhI61h7R92G1nouy8HyO
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20580) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
2074091f40149089c239847e2f42e955_JaffaCakes118description ioc process File opened for modification /dev/misc/watchdog 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for modification /dev/watchdog 2074091f40149089c239847e2f42e955_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
2074091f40149089c239847e2f42e955_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 2074091f40149089c239847e2f42e955_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
2074091f40149089c239847e2f42e955_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 2074091f40149089c239847e2f42e955_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
2074091f40149089c239847e2f42e955_JaffaCakes118description ioc process File opened for reading /proc/499/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/512/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1150/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1256/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/318/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1154/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1192/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1203/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1155/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1292/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1295/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1347/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1544/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/432/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/485/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/555/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1049/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/585/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/774/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1536/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1164/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1445/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/927/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/331/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/428/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1158/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1330/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1542/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1177/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/670/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/791/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1016/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1035/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1174/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1273/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1545/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/425/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/692/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/998/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/454/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1076/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1512/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/426/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/884/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/469/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1178/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1387/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1083/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1547/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/254/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1236/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/689/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1072/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1364/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1468/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/511/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1115/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1125/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/279/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1080/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/1184/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/534/fd 2074091f40149089c239847e2f42e955_JaffaCakes118 File opened for reading /proc/683/fd 2074091f40149089c239847e2f42e955_JaffaCakes118