Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
28-07-2024 09:07
Behavioral task
behavioral1
Sample
11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118
Resource
ubuntu2204-amd64-20240729-en
General
-
Target
11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118
-
Size
1.2MB
-
MD5
11cd74a9da31d75a719ef1f86dcc48ca
-
SHA1
66674fc12df6cf0dab75fdbbb4c0fedb7c011bb7
-
SHA256
5e5ddc7681cdb1ebd1faf2710e5a96678728f0989073dfe1f984dfe9ee4b29d8
-
SHA512
11bc310835d359d181beb7a861294fbf20f8f4a0872cc034ea7461c8792254c9aa5d28820bfbb3ccfe8ea9c70c57f20ef7ba653a0138f7cd86c03ac4eefb8952
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX412y1q2rJp0:745vRVJKGtSA0VWeo8u9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
Processes:
resource yara_rule /usr/bin/bsd-port/getty family_mrblack -
Executes dropped EXE 2 IoCs
Processes:
getty.sshdioc pid process /usr/bin/bsd-port/getty 1533 getty /usr/bin/.sshd 1555 .sshd -
Processes:
11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118gettydescription ioc process File opened for modification /etc/init.d/DbSecuritySpt 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /etc/init.d/selinux getty -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
gettydescription ioc process File opened for reading /proc/net/route getty -
Write file to user bin folder 1 TTPs 12 IoCs
Processes:
cpgetty11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118cpcpcpcpcpcpcpdescription ioc process File opened for modification /usr/bin/ss cp File opened for modification /usr/bin/bsd-port/conf.n getty File opened for modification /usr/bin/bsd-port/getty.lock 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/ps cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/udevd.lock 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/bsd-port/getty.lock getty File opened for modification /usr/bin/.sshd cp -
Writes file to system bin folder 1 TTPs 3 IoCs
Processes:
cpcpcpdescription ioc process File opened for modification /bin/lsof cp File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118gettydescription ioc process File opened for reading /proc/cpuinfo 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for reading /proc/cpuinfo getty -
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118gettydescription ioc process File opened for reading /proc/net/dev 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for reading /proc/net/dev getty File opened for reading /proc/net/route getty File opened for reading /proc/net/arp getty -
Reads runtime system information 37 IoCs
Reads data from /proc virtual filesystem.
Processes:
cpcpmkdirmkdirmkdirmkdir11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118mkdirmkdircpmkdirmkdir.sshdcpmkdirmkdirmkdircpcpmkdircpgettycpmkdirmkdirinsmodcpcpmkdircpinsmodmkdirmkdirdescription ioc process File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version .sshd File opened for reading /proc/filesystems cp File opened for reading /proc/meminfo 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/meminfo getty File opened for reading /proc/filesystems cp File opened for reading /proc/stat 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for reading /proc/sys/kernel/version getty File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat getty File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
Processes:
.sshd11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118description ioc process File opened for modification /tmp/notify.file .sshd File opened for modification /tmp/gates.lod .sshd File opened for modification /tmp/moni.lod 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /tmp/bill.lock 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /tmp/gates.lod 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /tmp/notify.file 11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 File opened for modification /tmp/moni.lod .sshd
Processes
-
/tmp/11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118/tmp/11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes1181⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1510 -
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"2⤵PID:1515
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt3⤵PID:1516
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"2⤵PID:1517
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt3⤵PID:1518
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"2⤵PID:1519
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt3⤵PID:1520
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"2⤵PID:1521
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt3⤵PID:1522
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"2⤵PID:1523
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt3⤵PID:1524
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1525
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1526 -
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1527
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1528 -
/bin/shsh -c "cp -f /tmp/11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 /usr/bin/bsd-port/getty"2⤵PID:1529
-
/usr/bin/cpcp -f /tmp/11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 /usr/bin/bsd-port/getty3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1530 -
/bin/shsh -c /usr/bin/bsd-port/getty2⤵PID:1532
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty3⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1533 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1541
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1542
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1543
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1544
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1545
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1546
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1547
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1548
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1549
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1550
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1551
-
/usr/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1552 -
/bin/shsh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1556
-
/usr/bin/cpcp -f /bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1557 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1558
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1559 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1560
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1561 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"4⤵PID:1562
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/lsof5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1563 -
/bin/shsh -c "chmod 0755 /bin/lsof"4⤵PID:1564
-
/usr/bin/chmodchmod 0755 /bin/lsof5⤵PID:1565
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1566
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1567 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1568
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1569 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1570
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1571 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"4⤵PID:1572
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1573 -
/bin/shsh -c "chmod 0755 /bin/ps"4⤵PID:1574
-
/usr/bin/chmodchmod 0755 /bin/ps5⤵PID:1575
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"4⤵PID:1576
-
/usr/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1577 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1578
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1579 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1580
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1581 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"4⤵PID:1582
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1583 -
/bin/shsh -c "chmod 0755 /bin/ss"4⤵PID:1584
-
/usr/bin/chmodchmod 0755 /bin/ss5⤵PID:1585
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1586
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1587 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1588
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1589 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"4⤵PID:1590
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1591 -
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵PID:1592
-
/usr/bin/chmodchmod 0755 /usr/bin/lsof5⤵PID:1593
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1594
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1595 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1596
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1597 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"4⤵PID:1598
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1599 -
/bin/shsh -c "chmod 0755 /usr/bin/ps"4⤵PID:1600
-
/usr/bin/chmodchmod 0755 /usr/bin/ps5⤵PID:1601
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1602
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1603 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1604
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1605 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"4⤵PID:1606
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1607 -
/bin/shsh -c "chmod 0755 /usr/bin/ss"4⤵PID:1608
-
/usr/bin/chmodchmod 0755 /usr/bin/ss5⤵PID:1609
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"4⤵PID:1614
-
/usr/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko5⤵
- Reads runtime system information
PID:1615 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1535
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1536 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1537
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1538 -
/bin/shsh -c "cp -f /tmp/11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 /usr/bin/.sshd"2⤵PID:1539
-
/usr/bin/cpcp -f /tmp/11cd74a9da31d75a719ef1f86dcc48ca_JaffaCakes118 /usr/bin/.sshd3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1540 -
/bin/shsh -c /usr/bin/.sshd2⤵PID:1554
-
/usr/bin/.sshd/usr/bin/.sshd3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1555 -
/bin/shsh -c "insmod /tmp/xpacket.ko"2⤵PID:1612
-
/usr/sbin/insmodinsmod /tmp/xpacket.ko3⤵
- Reads runtime system information
PID:1613
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64B
MD588cc0e3613da736f2e693195cd66564f
SHA13dabc292a7a4f94ff17a64181c3523d3ab5b2248
SHA256d144d130ba550b13194e22c2f48f3db724df66bbe92faad96b29db6e68252ee7
SHA51294a71f96aa0b70c1fadd7520d5dfd94b761ffe06a659702405b2a74721e0404f36ff8de1cf01e892ce92b80d7fb1cabd80e2b8c02d7d6291614d0b65fb6e9236
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD5ebb71045453f38676c40deb9864f811d
SHA1810bd2adca8109e71a0fa4995bb7a965fd8d905a
SHA2560d0c9bc37ae955b26c8bfecc22fcd072c4ea5ce95947a5051b5ed7399bff4f2e
SHA5123a3fc2e1174cf6fa5acf3b1d706c3f21b85915b8f7bc2bae7c5ca6ceb86fc5377e33ff347264e1dd620fcba5fec174ae4b8793e7a9aaaf2b0ec06d85e077efdf
-
Filesize
4B
MD5a14ac55a4f27472c5d894ec1c3c743d2
SHA165ccba0dc0797b93da4d0d0544d00cfcb8d54c4d
SHA25631d8edb99534fd4800651db4d241d86e0380fa7376718b88590c2d772b41d5f4
SHA512f7315a536fa0d5684625b33ec202aa7fdd89ed86b4f723e80d3dd89f5975e4d96c85ee549c62a17679afbbc8fcafa1e86cfae567c1e29660fbf28405eed914a7
-
Filesize
51B
MD5a34f3f023ed33ca648744f8887901176
SHA13fa0b19fcda5937928b5382ead2ae8684979d859
SHA256a6479c2a73a02a4905259d84672641d7c238307aa54a06f40a37d14454c4cb10
SHA51289c52e98126d45f6170d9f69e69db649bb967832f7f2331576fcdbbf40d6908069c48afe654c8f324a301a1fc71c7cf6c4e98d9ffc06071eecd25420b8973114
-
Filesize
73B
MD598507e5fc90a396e3216317135a7197e
SHA14028793e81d8cf0b89de976a82d9d5ca3d612038
SHA2565c478f60c8a6e616f8c35828a5453a9c57ddd59ef7df21c4143e2e7f0b19f6ca
SHA51249e43b7311e588fed613e05de222b78b5450e4445748565f78c986773cda523797f5b302b98b8b3ddaa3b31ad28ae99143be8517d4e80ec3a340009e7f470b73
-
Filesize
1.2MB
MD511cd74a9da31d75a719ef1f86dcc48ca
SHA166674fc12df6cf0dab75fdbbb4c0fedb7c011bb7
SHA2565e5ddc7681cdb1ebd1faf2710e5a96678728f0989073dfe1f984dfe9ee4b29d8
SHA51211bc310835d359d181beb7a861294fbf20f8f4a0872cc034ea7461c8792254c9aa5d28820bfbb3ccfe8ea9c70c57f20ef7ba653a0138f7cd86c03ac4eefb8952
-
Filesize
163KB
MD5ab57b66cc531ae0f996963223e632b60
SHA1bf7e5becd33f21c2539f5a75ffa0ab61c49c8795
SHA2562484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df
SHA512908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6
-
Filesize
138KB
MD58146139c2ad7e550b1d1f49480997446
SHA1074db8890c3227bd8a588417f5b9bde637bcf3af
SHA256207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f
SHA512b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de
-
Filesize
125KB
MD51b25ac945efae8520ba112b500e2d561
SHA18324c4d1d1427829266e82f203386232ff82af15
SHA2565eb16d9a8bc81fe767725874e3f67623b8e86b46ec93546be49c5b09d3ab4636
SHA512e191f967170ea4844f736c5ab75b7bf45fef3af34f0a4bef0d36475d646b0b089449fe39806664b9f6ce1984037687930cc368892230662c8c30f67fa3ac216e