18623f3d8267e5308370bf0b018bd3acf65e7faf563c6797aaffa3d88d012f00

General

Target

58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
Size

64KB
MD5

58815be903baf6b0ce062f1c48f67eb9
SHA1

9ccd4f311ba515aaf37f91c9402e104bf57da4ae
SHA256

18623f3d8267e5308370bf0b018bd3acf65e7faf563c6797aaffa3d88d012f00
SHA512

5312615d12fcab7e785778587f8366908b702fbe137c7e2cc6003c86449c114ea89f8ff0e7faa64572dba7d472eb53e47d3fc2b4fd72310aeb452de9d062af0c
SSDEEP

1536:IoRC9170vwHbQXZ5+qXDEuX690dSW7V/DjObeFt6PuQ4ZF:PC917iwHbQXZ5+qXAd94SWZ/XObeb6G7

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (20694) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for modification	/dev/misc/watchdog	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
Enumerates running processes
Discovers information about currently running processes on the system
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

description	ioc	process
File opened for reading	/proc/454/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1601/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1981/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2016/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2031/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1089/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1127/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/446/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1550/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/464/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/474/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1046/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1508/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1728/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1122/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1185/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/609/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1768/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2096/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/444/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/965/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1921/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2026/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2101/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/609/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/698/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1274/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/464/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/476/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/492/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1584/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1156/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1195/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1052/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1516/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1805/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2067/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1498/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1499/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1553/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1985/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/477/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/586/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1904/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/426/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1500/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1803/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1513/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1591/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1200/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1997/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1563/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1712/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2160/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/533/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1798/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/2085/exe	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/953/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/965/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1192/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/426/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/1340/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
File opened for reading	/proc/465/fd	58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118

/tmp/58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
/tmp/58815be903baf6b0ce062f1c48f67eb9_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1502