0ce5bdeadb6d824061af3751e61b54577f4430d1985b3dce38b6a4081ad59fe9

Analysis

max time kernel
148s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13-05-2024 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb2272e9a121654edd2b7338c66d591_JaffaCakes118
Size

86KB
MD5

3cb2272e9a121654edd2b7338c66d591
SHA1

1fa194a12de67b7f83b1349246b504b31d0ef12b
SHA256

0ce5bdeadb6d824061af3751e61b54577f4430d1985b3dce38b6a4081ad59fe9
SHA512

44e7783f4599f7d3716cd909eb3c8dae86786bedd36be4bcdede20dbab89743e521b49329b254f9b211fc08fb38e5891e3547273084fe4162a871e7e65133082
SSDEEP

1536:qvu1gtrMtjWqtgI6kev6mJgyPyp6z7m4fkr6iLHzEC5wOHkIpHqJRU:qW1gHqWLDv6gPyu7zCDLHzE2wOEIp

Score

6^/10

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

description ioc process

File opened for reading /proc/net/route 3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

Changes its process name 1 IoCs

Processes:

3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	/usr/sbin/dropbear	1476	3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

description ioc process

File opened for reading /proc/net/route 3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	3cb2272e9a121654edd2b7338c66d591_JaffaCakes118

/tmp/3cb2272e9a121654edd2b7338c66d591_JaffaCakes118
/tmp/3cb2272e9a121654edd2b7338c66d591_JaffaCakes118
1⤵
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads