Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
11/08/2024, 00:21
General
-
Target
8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118
-
Size
29KB
-
MD5
8843c2dec944c37ba68ccbbf08ae8ade
-
SHA1
eca0b0c4165b725dd035e4689aedd7aff039362d
-
SHA256
1c24e490fdf0669a1b7ebff8edac35c4343094b2990e14ecd502a5b6a1dafd03
-
SHA512
d6b0f48cf5c4222d40872faa6242dfb09ab3f49437da61be92eeb3d28e912827fc7865e58d7c3a295a19fe9b16dbc5ee9c01ca403c000dea0bc56a0579142b63
-
SSDEEP
768:dNUb6MdbhjC0wbseI9aK81VDhaHc9RQbJgGlzDpbuR1J6:TtT0WdK8wmQRVJuA
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20424) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for modification /dev/misc/watchdog 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/722/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/732/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/958/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/960/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1267/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1321/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1375/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/742/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1100/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1187/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/797/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/860/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1134/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1210/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1466/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1567/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/888/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1138/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1155/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1222/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1278/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1364/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1552/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1263/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/174/fd 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/453/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/793/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1056/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1225/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1251/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1257/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1454/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1/fd 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/964/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1024/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1112/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1146/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1203/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1429/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/882/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1245/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1289/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/682/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/880/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1434/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/358/fd 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/725/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/818/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1272/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1354/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1127/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1428/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/248/fd 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1231/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1242/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1238/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1420/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1465/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1525/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/1030/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/153/fd 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/723/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/900/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118 File opened for reading /proc/938/exe 8843c2dec944c37ba68ccbbf08ae8ade_JaffaCakes118