4582d8151d7f83282065f5a3b91b3fb1852f0e2c65175da72b5ce129006bbe92

Analysis

max time kernel
148s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20240729-en
resource tags

arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
17-08-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
Size

149KB
MD5

a4648076a359fcdc54ba49fe25513fcd
SHA1

ea05b6cb884662895b79e0ac081dfa31e14f5be6
SHA256

4582d8151d7f83282065f5a3b91b3fb1852f0e2c65175da72b5ce129006bbe92
SHA512

7158d4b49c91c3e4b068ef342d2ea5e1459c465802e5802829cc222f31c10790795ff735f4b3acc7d2c0a4162a719b23bfaf49396f00f51b47ef26f9e3b6c3a3
SSDEEP

3072:d4CMuNlB8o0Djn7k6JsJGB9mrsplDKZUWQBKXAVanwX+F8JyvsPhLn8YhLJzVfN9:d4CMuNlB8o0Djn7k6J/B9mrsplDKZUW0

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (20293) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for modification	/dev/misc/watchdog	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/tcp	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/185/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/211/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/339/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/346/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/712/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/328/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/349/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/705/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/630/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/700/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/1/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/369/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/646/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/287/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/645/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/678/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/695/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/275/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/326/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/358/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/354/fd	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/708/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/661/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/664/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/701/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
File opened for reading	/proc/735/exe	a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118

/tmp/a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
/tmp/a4648076a359fcdc54ba49fe25513fcd_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
- Reads runtime system information
PID:702

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads