Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240418-en -
resource tags
-
submitted
08/05/2024, 04:13
General
-
Target
23243b70487399d30ab04071d8a4e511_JaffaCakes118
-
Size
111KB
-
MD5
23243b70487399d30ab04071d8a4e511
-
SHA1
045060502b1407547326e86c9bd28d094e89fdb2
-
SHA256
d51842bf8d89f0a90bd5967ab55a172499b37e11d651ee59fdce4802e8cfb718
-
SHA512
0d9d6aef9d15c228ce85b1966d7ad20f9d32273ac03d6479cdb43c3fddcc6dc293ff8def79e6189dd6647de40c43514663e8a03e980a48893031b692b04d1712
-
SSDEEP
3072:Qk2jYylW7An93gGWzw9Vyxnr6jlmqKkcLJSYnLj9:Qpv0GvRyxnr6JmqKkcLJSYnLj9
Malware Config
Signatures
-
Contacts a large (23682) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/23243b70487399d30ab04071d8a4e511_JaffaCakes118/tmp/23243b70487399d30ab04071d8a4e511_JaffaCakes1181⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration