Analysis
-
max time kernel
123s -
max time network
151s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240418-en -
resource tags
-
submitted
13/07/2024, 19:29
General
-
Target
430943c3b279082858a61300a1c3c668_JaffaCakes118
-
Size
36KB
-
MD5
430943c3b279082858a61300a1c3c668
-
SHA1
418a12aa60a3483e083af9e28ed42a9c61395d00
-
SHA256
50561b86cfaa3bb6d217de0ea07cdff3370652ea0585d35ce84d3f156dac9509
-
SHA512
78279c9c8cd39c9552bf55affdf13170f8d7a3ac9f3d4caad416585c4c016e5eadf464e77553d0dd431a89bf4f74f320a297cf3ab6d44d0df304daa15310530e
-
SSDEEP
768:pIUrtJMqIsQIQfmjeNqimblnKqCQFhGKqeuyfXqGlua5odOXWRN:5rtCsa+C4RlKSGKiyfXzDodOO
Malware Config
Signatures
-
Contacts a large (19116) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 25 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/430943c3b279082858a61300a1c3c668_JaffaCakes118/tmp/430943c3b279082858a61300a1c3c668_JaffaCakes1181⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information