Analysis
-
max time kernel
143s -
max time network
147s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-05-2024 07:02
Behavioral task
behavioral1
Sample
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
General
-
Target
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118
-
Size
54KB
-
MD5
5dc4058081bfd47b71a62b4e180407cf
-
SHA1
33c59c9758ae88612a97a1846058fa9b7bd86cd0
-
SHA256
ab10d59a0b53cf2ceafc0dde68c361538f53f6c870375230060dd9104ecb2e5b
-
SHA512
b88b07d63f4e1fb22e08038a5ac1b59b70ddd4868de234dbc9a21a81b4b96fd7dbc286c72e7a51e2431303230f421c393140ae673ee1b92e21d103a9a577056e
-
SSDEEP
768:wctW5eWYK3IPHjD2b7BKPJ1NB/TTfBPJfFaHb7W4dzZ7eOYxc39o:wYWYK3CHjDC7wPjNB3fs77WizZ7elxc
Malware Config
Signatures
-
Contacts a large (24627) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118pid process 1507 5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118description ioc process File opened for modification /dev/watchdog 5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118 File opened for modification /dev/misc/watchdog 5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118 -
Changes its process name 1 IoCs
Processes:
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118description pid process Changes the process name, possibly in an attempt to hide itself 1507 5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 5dc4058081bfd47b71a62b4e180407cf_JaffaCakes118