Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
12-06-2024 10:19
Behavioral task
behavioral1
Sample
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118
Resource
ubuntu2004-amd64-20240611-en
General
-
Target
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118
-
Size
1.2MB
-
MD5
a04c47869c4a70eaf3075f34b470e8ed
-
SHA1
5dcb5a93c2165164f1df27a8be68612dc43f325e
-
SHA256
90380b846cc1835d332b61f6e7a4327d04d0a0071590bc389855c5a81600cd47
-
SHA512
266855f08011130a03c2c0b7cf6386b54092c27a7647b9086d89ff6d99638133295cfafca59500ea1340167c3e00d9b9fa66cbdb5239b91c347fc8debfc5545b
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX4W2y1q2rJp0:745vRVJKGtSA0VWeoFu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
Processes:
resource yara_rule /usr/bin/bsd-port/getty family_mrblack -
Executes dropped EXE 2 IoCs
Processes:
getty.sshdioc pid process /usr/bin/bsd-port/getty 1462 getty /usr/bin/.sshd 1479 .sshd -
Processes:
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118gettydescription ioc process File opened for modification /etc/init.d/DbSecuritySpt a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /etc/init.d/selinux getty -
Reads system routing table 1 TTPs 2 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118gettydescription ioc process File opened for reading /proc/net/route a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for reading /proc/net/route getty -
Write file to user bin folder 1 TTPs 12 IoCs
Processes:
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118gettycpcpcpcpcpcpcpcpdescription ioc process File opened for modification /usr/bin/bsd-port/udevd.lock a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /usr/bin/bsd-port/getty.lock getty File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/ps cp File opened for modification /usr/bin/bsd-port/getty.lock a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /usr/bin/bsd-port/conf.n getty File opened for modification /usr/bin/ss cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/getty cp -
Writes file to system bin folder 1 TTPs 3 IoCs
Processes:
cpcpcpdescription ioc process File opened for modification /bin/lsof cp File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
gettya04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118description ioc process File opened for reading /proc/cpuinfo getty File opened for reading /proc/cpuinfo a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 -
Reads system network configuration 1 TTPs 6 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118gettydescription ioc process File opened for reading /proc/net/route a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for reading /proc/net/arp a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for reading /proc/net/route getty File opened for reading /proc/net/arp getty File opened for reading /proc/net/dev getty File opened for reading /proc/net/dev a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 -
Reads runtime system information 37 IoCs
Reads data from /proc virtual filesystem.
Processes:
a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118insmodmkdirmkdirmkdircp.sshdmkdircpmkdirmkdirmkdirinsmodmkdircpcpmkdirgettycpcpmkdirmkdirmkdircpmkdirmkdircpmkdirmkdircpmkdircpcpdescription ioc process File opened for reading /proc/meminfo a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/sys/kernel/version .sshd File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version getty File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat getty File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/sys/kernel/version a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/meminfo getty -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes:
.sshda04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118description ioc process File opened for modification /tmp/gates.lod .sshd File opened for modification /tmp/moni.lod a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /tmp/bill.lock a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /tmp/gates.lod a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /tmp/notify.file a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 File opened for modification /tmp/moni.lod .sshd File opened for modification /tmp/notify.file .sshd File opened for modification /tmp/conf.n a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118
Processes
-
/tmp/a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118/tmp/a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes1181⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1397 -
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"2⤵PID:1444
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt3⤵PID:1445
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"2⤵PID:1446
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt3⤵PID:1447
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"2⤵PID:1448
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt3⤵PID:1449
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"2⤵PID:1450
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt3⤵PID:1451
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"2⤵PID:1452
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt3⤵PID:1453
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1454
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1455 -
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1456
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1457 -
/bin/shsh -c "cp -f /tmp/a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 /usr/bin/bsd-port/getty"2⤵PID:1458
-
/usr/bin/cpcp -f /tmp/a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 /usr/bin/bsd-port/getty3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1459 -
/bin/shsh -c /usr/bin/bsd-port/getty2⤵PID:1461
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty3⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1462 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1470
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1471
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1472
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1473
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1474
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1475
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1476
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1480
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1481
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1482
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1483
-
/usr/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1484 -
/bin/shsh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1485
-
/usr/bin/cpcp -f /bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1486 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1487
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1488 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1489
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1490 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"4⤵PID:1491
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/lsof5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1492 -
/bin/shsh -c "chmod 0755 /bin/lsof"4⤵PID:1493
-
/usr/bin/chmodchmod 0755 /bin/lsof5⤵PID:1494
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1495
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1496 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1497
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1498 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1499
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1500 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"4⤵PID:1501
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1502 -
/bin/shsh -c "chmod 0755 /bin/ps"4⤵PID:1503
-
/usr/bin/chmodchmod 0755 /bin/ps5⤵PID:1504
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"4⤵PID:1505
-
/usr/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1506 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1507
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1508 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1509
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1510 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"4⤵PID:1511
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1512 -
/bin/shsh -c "chmod 0755 /bin/ss"4⤵PID:1513
-
/usr/bin/chmodchmod 0755 /bin/ss5⤵PID:1514
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1515
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1516 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1517
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1518 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"4⤵PID:1519
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1520 -
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵PID:1521
-
/usr/bin/chmodchmod 0755 /usr/bin/lsof5⤵PID:1522
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1523
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1524 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1525
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1526 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"4⤵PID:1527
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1528 -
/bin/shsh -c "chmod 0755 /usr/bin/ps"4⤵PID:1529
-
/usr/bin/chmodchmod 0755 /usr/bin/ps5⤵PID:1530
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1531
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1532 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1533
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1534 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"4⤵PID:1535
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1536 -
/bin/shsh -c "chmod 0755 /usr/bin/ss"4⤵PID:1537
-
/usr/bin/chmodchmod 0755 /usr/bin/ss5⤵PID:1538
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"4⤵PID:1541
-
/usr/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko5⤵
- Reads runtime system information
PID:1544 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1464
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1465 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1466
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1467 -
/bin/shsh -c "cp -f /tmp/a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 /usr/bin/.sshd"2⤵PID:1468
-
/usr/bin/cpcp -f /tmp/a04c47869c4a70eaf3075f34b470e8ed_JaffaCakes118 /usr/bin/.sshd3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1469 -
/bin/shsh -c /usr/bin/.sshd2⤵PID:1478
-
/usr/bin/.sshd/usr/bin/.sshd3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1479 -
/bin/shsh -c "insmod /tmp/xpacket.ko"2⤵PID:1549
-
/usr/sbin/insmodinsmod /tmp/xpacket.ko3⤵
- Reads runtime system information
PID:1550
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64B
MD549c77268bb94a49ab121622d3d2c7382
SHA10120545395ce95fe78313f1f212389ee5ae426e0
SHA256ae86a97eca9a01895a95773b27c6f9fedb2ffae10e048b7a74bafae8c16d679f
SHA512bc5fbe0ea0544a690e5644058c8e92540faebb7645150ca2249349093dc3238111d3a7ad08e78c15aeb2e71c05917c02200385dece7f2bbf9ed3f997e322224c
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD59701a1c165dd9420816bfec5edd6c2b1
SHA1e4b5a2b01ee1b51b2d17a165855b43c142d822c4
SHA256afd679cd3f9a81fd9ce02e6434a24f848937f09909fabcc3b3781e06036e284c
SHA512f4596df70f72dc79c62da6b3a8af26ff242ae224525a1e241006735ddc8b04bf95c59b03bf095873e1fcfa28a68029146a9f8f66ddf0198710448b385eb1721c
-
Filesize
4B
MD517e23e50bedc63b4095e3d8204ce063b
SHA1464f9d1621f0799f4c4b7a2e884b21e4be81d222
SHA256731d65cdd441fde25333a70782a078911af63ef672e299a906030e16ff66756b
SHA512500dc81d5bd51e4e1bfa0ccfd7922d2c1da081a86844cd976c5c9e0d896dd78ec1631324cb634142875271e66c4800f8631a7d6dcef2ab5705f758d7e38dd7c3
-
Filesize
51B
MD563c0f5807aa60c188a6198b5582bd293
SHA1d6be81a6888c6c3b97eb075f953ea5b190dafcce
SHA256dd4375a0ede637395659d87687e926c6966cd776be8fc7ecc9ebf02d1531dd0f
SHA5129b959d8ee5a250863fbb81b3683de5d76fbf19df6c62afecf9bc9df98e8ca46fd8313d3cb2d7457c4f489f49544e768ce501a491d4d30cbf32d0bc2f784eff30
-
Filesize
73B
MD58661c3d82087b57220bb817c06c7ab1e
SHA1ed09895f54a3020552882e0d01975d868fd62187
SHA256e364d0737fc2c1f96c0f4e3cb002c24daac056f861a9f4c1c359977efd4f148a
SHA512af5eec9a17188a4be2c77257dc0ef47012a41612f3c73c11f8e3588c7cc528181cc877d8101066f2ebe47c97a9afcbd999c8215748a8aa940aa88d65ff51f6a5
-
Filesize
1.2MB
MD5a04c47869c4a70eaf3075f34b470e8ed
SHA15dcb5a93c2165164f1df27a8be68612dc43f325e
SHA25690380b846cc1835d332b61f6e7a4327d04d0a0071590bc389855c5a81600cd47
SHA512266855f08011130a03c2c0b7cf6386b54092c27a7647b9086d89ff6d99638133295cfafca59500ea1340167c3e00d9b9fa66cbdb5239b91c347fc8debfc5545b
-
Filesize
171KB
MD5061386937ec7acf924438a2643a32be0
SHA101a044b9e58839bea3e58c66cb32acc16241bf91
SHA2568a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959
SHA5122de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7
-
Filesize
134KB
MD5d194576b899af45b1d2a448612ec21e5
SHA1492f7d8f28cd4397ce22fcf0d8bf3304ea93465a
SHA256a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca
SHA512b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539
-
Filesize
164KB
MD551d83131b398a97dd38555ba57084721
SHA17d392a87f7db787dfa85fbcdf2a5ba6f0b59b4ed
SHA256e429f9d16a4cd64593b94dee8309a427fe8ca57765bf0d2e7b822efd123fe768
SHA512adc7137df75410c2535986c1e86c2e92e58f9bee70094f72f1f7adf3db125720ce281eb3f48474b0e192d672e96cbb1bc6e1ef6b26b10bf76a412c4516948216