Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26-06-2024 13:52
Static task
static1
General
-
Target
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118
-
Size
35KB
-
MD5
1234a7ab6996aea4b3d2e344ea102d81
-
SHA1
5b6f469940856194a1ed9c933d67e2f91df7ff44
-
SHA256
62ed5a5e76d64384e85b59acb063773ebcbb542d978b5e3bfc811a7ff5a000e2
-
SHA512
5ad8afa0b6b13d17a3ae09a6b969712a1a6c61497b8273912fffd1073c7bfb4fba776b190e15b592312643361f0f3720c5ca21b4afcac8c394c4a36988546b75
-
SSDEEP
768:Gk1Ad+hrTxdXhyT1vSjCXnaOfk2xNS8UFr7YuEtHga7nZA3Us:Gk1AdGrTxdXh4vSjCXaV22vYTAa7nY
Malware Config
Extracted
mirai
KYTON
Signatures
-
Contacts a large (112291) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118description ioc process File opened for modification /dev/watchdog 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 File opened for modification /dev/misc/watchdog 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 -
Writes file to system bin folder 1 TTPs 1 IoCs
Processes:
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118description ioc process File opened for modification /bin/watchdog 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 -
Changes its process name 1 IoCs
Processes:
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118description ioc pid process Changes the process name, possibly in an attempt to hide itself RG5IHTPRAqsfmVUsGxp7Fox7cujc8cb6 631 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 -
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes:
1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118description ioc process File opened for reading /proc/self/exe 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118 File opened for reading /proc/634/exe 1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118
Processes
-
/tmp/1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118/tmp/1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes1181⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:631