Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    26-06-2024 13:52

General

  • Target

    1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118

  • Size

    35KB

  • MD5

    1234a7ab6996aea4b3d2e344ea102d81

  • SHA1

    5b6f469940856194a1ed9c933d67e2f91df7ff44

  • SHA256

    62ed5a5e76d64384e85b59acb063773ebcbb542d978b5e3bfc811a7ff5a000e2

  • SHA512

    5ad8afa0b6b13d17a3ae09a6b969712a1a6c61497b8273912fffd1073c7bfb4fba776b190e15b592312643361f0f3720c5ca21b4afcac8c394c4a36988546b75

  • SSDEEP

    768:Gk1Ad+hrTxdXhyT1vSjCXnaOfk2xNS8UFr7YuEtHga7nZA3Us:Gk1AdGrTxdXh4vSjCXaV22vYTAa7nY

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Contacts a large (112291) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118
    /tmp/1234a7ab6996aea4b3d2e344ea102d81_JaffaCakes118
    1⤵
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Writes file to system bin folder
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:631

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/631-1-0x00008000-0x00028c68-memory.dmp