Analysis
-
max time kernel
96s -
max time network
155s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
11/08/2024, 14:33
General
-
Target
8abc64503d7337ba02668de9302966d5_JaffaCakes118
-
Size
23KB
-
MD5
8abc64503d7337ba02668de9302966d5
-
SHA1
c8a429b8d9da71854fa8436bfb7054e730f37c13
-
SHA256
97afe6e343c8273426504787ecbd186c9b4785dfa71156fe9b038b918a17a616
-
SHA512
76dac9300fdbcc9a7d98b95ef6c7dd1b554e78a2782e4f3a77c54f70ed3af1f06777201f8ff001701d7bd54cc03c15d3fc79f1732cec4c8b78d8c061e4e59f36
-
SSDEEP
384:c6ynTYYNND5cLfj6laZtdlIbrMwKvPe4Y/2j5RYCQbV0bvCoJuPVeahAF3:c60rN7eWaxuEwKvmR2jACSV0bqocpmN
Malware Config
Signatures
-
Contacts a large (88642) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for modification /dev/misc/watchdog 8abc64503d7337ba02668de9302966d5_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp 8abc64503d7337ba02668de9302966d5_JaffaCakes118 -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ["kpthread"] 703 8abc64503d7337ba02668de9302966d5_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp 8abc64503d7337ba02668de9302966d5_JaffaCakes118 -
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/700/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/702/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/710/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/502/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/515/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/562/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/689/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/701/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/714/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/744/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/752/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/558/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/680/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/697/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/707/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/732/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/742/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/695/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/705/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/709/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118 File opened for reading /proc/745/maps 8abc64503d7337ba02668de9302966d5_JaffaCakes118