5e7b89f7dee827d08917189f8dff6ae2011ae41400734fd743ca1ba6564acd03

General

Target

30c934df961394d6fc706e30fe7cec49_JaffaCakes118
Size

72KB
MD5

30c934df961394d6fc706e30fe7cec49
SHA1

417d3f7e252bd098c564708207011ffb9e8ab831
SHA256

5e7b89f7dee827d08917189f8dff6ae2011ae41400734fd743ca1ba6564acd03
SHA512

79171ff4258920a3a7195185aa73d63bb5165c1771379e0c19302d869248f948555b3e718a606b540a7b0e234a70f3c8a00be4347f8d3c2b3e1a9bd7b47239f6
SSDEEP

1536:sEtOX3Px857M8VVqXo8lGKloNwm87Ze100rsSWg/M3AviAOR6BeY4wnv:xtOnPx857M8VVqXospV04SWg/xviv68q

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (20666) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

30c934df961394d6fc706e30fe7cec49_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for modification	/dev/misc/watchdog	30c934df961394d6fc706e30fe7cec49_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

30c934df961394d6fc706e30fe7cec49_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 30c934df961394d6fc706e30fe7cec49_JaffaCakes118
Enumerates running processes
Discovers information about currently running processes on the system
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

30c934df961394d6fc706e30fe7cec49_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 30c934df961394d6fc706e30fe7cec49_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	30c934df961394d6fc706e30fe7cec49_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	30c934df961394d6fc706e30fe7cec49_JaffaCakes118

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

30c934df961394d6fc706e30fe7cec49_JaffaCakes118

description	ioc	process
File opened for reading	/proc/958/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1489/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1900/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/451/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1021/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1027/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1498/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/451/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1558/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/888/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/536/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1313/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/429/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/666/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1903/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1973/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2067/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1672/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2054/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/422/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/472/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/958/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1087/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1179/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1578/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/679/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/718/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2139/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/484/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1552/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1889/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1958/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1982/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2000/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/682/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1123/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1331/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1920/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2120/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/700/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1002/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1534/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1895/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/576/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/666/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1184/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1886/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2070/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1106/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/449/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/673/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1137/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1165/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/673/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1054/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1119/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1532/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1980/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2127/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/308/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1064/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1177/fd	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/1932/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118
File opened for reading	/proc/2005/exe	30c934df961394d6fc706e30fe7cec49_JaffaCakes118

/tmp/30c934df961394d6fc706e30fe7cec49_JaffaCakes118
/tmp/30c934df961394d6fc706e30fe7cec49_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1492