Analysis
-
max time kernel
143s -
max time network
151s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
10-05-2024 23:16
Behavioral task
behavioral1
Sample
318836172f722942b7951a15e6902a22_JaffaCakes118
Resource
ubuntu2004-amd64-20240508-en
General
-
Target
318836172f722942b7951a15e6902a22_JaffaCakes118
-
Size
54KB
-
MD5
318836172f722942b7951a15e6902a22
-
SHA1
d50ab015d68481bd34690cabea05b4a1c84cc114
-
SHA256
d6529a968dbf570cf211d43a8f7f353dc58d4bd33096f1b5ef97dd1e0cff578b
-
SHA512
5c07ea5b8c75bb073bffa0bf70e4e79a5602175fb637a336bbb1556ac44ada0e94b4603a962f4867efb63a4017fc81ced7bea5b5cc707d5acc65264d25e1729c
-
SSDEEP
1536:d6EwVWibZ6uzpNrmvFtWbFB2WCTZbt+xc:QVWYZ6uzv4FKFB2WoZbQq
Malware Config
Signatures
-
Contacts a large (7355) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
318836172f722942b7951a15e6902a22_JaffaCakes118pid process 1414 318836172f722942b7951a15e6902a22_JaffaCakes118 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
318836172f722942b7951a15e6902a22_JaffaCakes118description ioc process File opened for modification /dev/watchdog 318836172f722942b7951a15e6902a22_JaffaCakes118 File opened for modification /dev/misc/watchdog 318836172f722942b7951a15e6902a22_JaffaCakes118 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
318836172f722942b7951a15e6902a22_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 318836172f722942b7951a15e6902a22_JaffaCakes118 -
Changes its process name 1 IoCs
Processes:
318836172f722942b7951a15e6902a22_JaffaCakes118description pid process Changes the process name, possibly in an attempt to hide itself 1414 318836172f722942b7951a15e6902a22_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
318836172f722942b7951a15e6902a22_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 318836172f722942b7951a15e6902a22_JaffaCakes118