Overview

overview

10

Static

static

10

87ae7aa0b3...kes118

ubuntu-22.04-amd64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    10/08/2024, 21:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    87ae7aa0b34dab70967daf70532f90bb_JaffaCakes118

  • Size

    94KB

  • MD5

    87ae7aa0b34dab70967daf70532f90bb

  • SHA1

    9df47b96cfb39778d14bb01dd492ccf8eb0c7eb6

  • SHA256

    921dda66267b44ac01ac45e2fda0ef34c373fb550ebe0dc699cfa578dbc87eb8

  • SHA512

    3cde9307ddfac4fcc6b71c6390b077d5f59d9b9b2050a0ceba01f4f511643e9905112364e4b0231d160bb6107e27213c7c8c717808c19de52a5b2b30755576d0

  • SSDEEP

    1536:E277J003UDTAUX8ELTXlPZ3KHHnJ3mjMQfbPKiFKjoewTqgqGYl2oPVMtceIt:E277J003uTAUX8OTlPZ3eHJ3i1jyzoeV

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Reads CPU attributes 1 TTPs 4 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/87ae7aa0b34dab70967daf70532f90bb_JaffaCakes118
    /tmp/87ae7aa0b34dab70967daf70532f90bb_JaffaCakes118
    1⤵
    • Deletes itself
    • Reads system routing table
    • Reads system network configuration
    • Reads runtime system information
    PID:1561
    • /bin/sh
      sh -c "kill -9 1562;pkill -9 1562 "
      2⤵
        PID:1568
        • /usr/bin/pkill
          pkill -9 "1562 "
          3⤵
          • Reads CPU attributes
          PID:1569
      • /bin/sh
        sh -c "kill -9 1563;pkill -9 1563 "
        2⤵
          PID:1570
          • /usr/bin/pkill
            pkill -9 "1563 "
            3⤵
            • Reads CPU attributes
            PID:1571
        • /bin/sh
          sh -c "kill -9 1564;pkill -9 1564 "
          2⤵
            PID:1572
            • /usr/bin/pkill
              pkill -9 "1564 "
              3⤵
              • Reads CPU attributes
              PID:1576
          • /bin/sh
            sh -c "kill -9 1567;pkill -9 1567 "
            2⤵
              PID:1577
              • /usr/bin/pkill
                pkill -9 "1567 "
                3⤵
                • Reads CPU attributes
                PID:1578

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads