Analysis
-
max time kernel
146s -
max time network
146s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-06-2024 06:36
Behavioral task
behavioral1
Sample
93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
3 signatures
150 seconds
General
-
Target
93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118
-
Size
1.0MB
-
MD5
93e2b0a77052b368554bb3c0e2a1e64b
-
SHA1
b42f5e1400e3c15c4beeb0278ddacf19e808765b
-
SHA256
8db0dab876d75b6a90b9f338aae514248be3b046e4df7956a60cc896aab48099
-
SHA512
cbeb659a8ba99c96c29b5cc4f84d123ad8bb370beee20609e54259dd2002145b0400e3dacfccd569a5e19e9b07bcfa42e6ee35ecefe9de16bfa16f04ca68f3b1
-
SSDEEP
24576:7sqZhvnhHXuhshNjm3Bp6gDgR16lwzBWa4ww649TrHg29XE/PhrgyUkNR9:JhvnhHXuhshNjK8AlGWao8rgyUk
Score
4/10
Malware Config
Signatures
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118description ioc process File opened for reading /proc/cpuinfo 93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 -
Reads CPU attributes 1 TTPs 1 IoCs
Processes:
93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118description ioc process File opened for reading /sys/devices/system/cpu/online 93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 -
Reads runtime system information 7 IoCs
Reads data from /proc virtual filesystem.
Processes:
mvsedsedsedsedsedseddescription ioc process File opened for reading /proc/filesystems mv File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed
Processes
-
/tmp/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118/tmp/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes1181⤵
- Checks CPU configuration
- Reads CPU attributes
-
/bin/shsh -c "chmod +x /etc/rc.local"2⤵
-
/bin/chmodchmod +x /etc/rc.local3⤵
-
/bin/shsh -c "mv /tmp/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 /etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118"2⤵
-
/bin/mvmv /tmp/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 /etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes1183⤵
- Reads runtime system information
-
/bin/shsh -c "cd /etc;chmod 777 93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118"2⤵
-
/bin/chmodchmod 777 93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes1183⤵
-
/bin/shsh -c "sed -i -e '/exit/d' /etc/rc.local"2⤵
-
/bin/sedsed -i -e /exit/d /etc/rc.local3⤵
- Reads runtime system information
-
/bin/shsh -c "sed -i -e '/^ | | \$/d' /etc/rc.local"2⤵
-
/bin/sedsed -i -e "/^ | | \$/d" /etc/rc.local3⤵
- Reads runtime system information
-
/bin/shsh -c "sed -i -e '/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118/d' /etc/rc.local"2⤵
-
/bin/sedsed -i -e /93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118/d /etc/rc.local3⤵
- Reads runtime system information
-
/bin/shsh -c "sed -i -e '2 i/etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 reboot' /etc/rc.local"2⤵
-
/bin/sedsed -i -e "2 i/etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 reboot" /etc/rc.local3⤵
- Reads runtime system information
-
/bin/shsh -c "sed -i -e '2 i/etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 start' /etc/rc.d/rc.local"2⤵
-
/bin/sedsed -i -e "2 i/etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 start" /etc/rc.d/rc.local3⤵
- Reads runtime system information
-
/bin/shsh -c "sed -i -e '2 i/etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 start' /etc/init.d/boot.local"2⤵
-
/bin/sedsed -i -e "2 i/etc/93e2b0a77052b368554bb3c0e2a1e64b_JaffaCakes118 start" /etc/init.d/boot.local3⤵
- Reads runtime system information