Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
10-06-2024 16:25
Behavioral task
behavioral1
Sample
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
General
-
Target
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118
-
Size
54KB
-
MD5
9b4cdf6a58246c2151b14dcbebefc00d
-
SHA1
d95cb8e0f8c7f21789cc396ef059c9bfe2495855
-
SHA256
a46eb94f7899c65eea4f5359dffdcdcf1e5d6266580c4baf0ceb07baedc725e1
-
SHA512
9a20d296c4315fe72cd9d315ec44b7bf9fe3d12d091bc64cc12e331d04af1b9db11d412b0b0eee4e1e721a7b1f1cb7e3c52fa22c451e58ce96550cd6b4ceccfc
-
SSDEEP
1536:36Ew7hWCbZ6OzptrGP85wXysWTF+7t+Rc:C1W4Z6OzP4NXysWp+7QK
Malware Config
Signatures
-
Contacts a large (23997) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118pid process 1504 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118description ioc process File opened for modification /dev/misc/watchdog 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for modification /dev/watchdog 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
Processes:
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118description pid process Changes the process name, possibly in an attempt to hide itself 1504 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118description ioc process File opened for reading /proc/1314/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/423/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1045/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1127/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1294/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/993/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1096/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1135/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1192/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/467/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/541/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/676/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1112/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/489/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/988/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1173/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/488/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1185/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1271/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/250/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/423/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/424/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1070/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/533/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/490/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/495/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/471/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/541/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/489/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1108/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/951/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1144/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/478/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/490/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1506/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/683/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/558/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1067/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1089/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/458/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/478/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/522/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/690/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1500/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/694/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1020/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1073/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1187/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/931/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1116/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1502/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/492/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/467/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/493/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/681/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/494/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1286/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1298/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/279/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/545/fd 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1126/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/1151/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/488/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118 File opened for reading /proc/673/exe 9b4cdf6a58246c2151b14dcbebefc00d_JaffaCakes118