18f187bf142035c31500e5a02920ab0ea1c70f80ed1a8e43c19f5b82a0c91cfe

General

Target

5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
Size

60KB
MD5

5b043729ecd745af6e2cb04850ce64e6
SHA1

d00ae3117ad4a7bb4eccfd4c9bfa85433014685d
SHA256

18f187bf142035c31500e5a02920ab0ea1c70f80ed1a8e43c19f5b82a0c91cfe
SHA512

ec541c57532c54f4d9e55a3dc699196293f7d14f5b587464ac9330eb1ba492c79e014025ba5d2eed7bc919e5b8b16e4478bd4f216064c4d553373dbfec155ce2
SSDEEP

1536:Gad2JCsoeHSEBmkOnPWZSWF/98VM2IgtjoqsYw:GaEJCsozQmkOnaSWF/9aM2dNVVw

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (20555) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for modification	/dev/misc/watchdog	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
Enumerates running processes
Discovers information about currently running processes on the system
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

description ioc process

File opened for reading /proc/net/tcp 5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/tcp	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

description	ioc	process
File opened for reading	/proc/1410/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/781/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/446/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1408/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/988/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/440/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1623/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/2009/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/671/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1482/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1356/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/479/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1767/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1113/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1352/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1369/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/691/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1034/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1354/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/781/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/978/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1468/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/242/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1558/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/2014/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1025/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1358/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/442/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/946/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/2185/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/479/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/611/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/2248/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/892/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1075/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/896/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/904/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1003/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1243/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1467/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1472/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1476/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/611/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1038/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/493/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1409/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/798/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/2277/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/635/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1124/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/806/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1694/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/923/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1020/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1328/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1415/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1030/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1592/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/482/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/535/fd	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1786/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/2048/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
File opened for reading	/proc/1600/exe	5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118

/tmp/5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
/tmp/5b043729ecd745af6e2cb04850ce64e6_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:1411