Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    16-07-2024 08:16

General

  • Target

    4d7f29f48da710448bdf72b4efd0aeb4_JaffaCakes118

  • Size

    31KB

  • MD5

    4d7f29f48da710448bdf72b4efd0aeb4

  • SHA1

    136f2b4f0b47b7fe04a15ae36515481a7f73d1ae

  • SHA256

    9134fc5163b23f489d56454e979b50252993fe74208167dfcf7be0c491fcdc7f

  • SHA512

    8667357d34b437197508770659ea74880809bebbc5b04bade559ce5710ef8992f6e7b000e86202aaed376dbf5f5adc13502069a7b0923a2364cd015211bf21ee

  • SSDEEP

    768:dL6y1JlHo+YXU1IxDqxNvkQC/oKfd2B9x16jNbJxc2OWs3Uoz+:Nh5uhDqvvkX/oKsduYz+

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Contacts a large (20241) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 29 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/4d7f29f48da710448bdf72b4efd0aeb4_JaffaCakes118
    /tmp/4d7f29f48da710448bdf72b4efd0aeb4_JaffaCakes118
    1⤵
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Reads system network configuration
    • Reads runtime system information
    PID:645

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/645-1-0x00008000-0x00024638-memory.dmp