52553bc961b877a5c2d5dde865554c00e2ff240cdd15fc984a6a2beb2b6fa55d

Analysis

max time kernel
144s
max time network
152s
platform
debian-12_mipsel
resource
debian12-mipsel-20240221-en
resource tags

arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
22/08/2024, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118
Size

77KB
MD5

b5b8d2636dc58fdc172091b3fcb0d865
SHA1

5fbf0a89ddd30573fb5eed36d74bb563bce68f1f
SHA256

52553bc961b877a5c2d5dde865554c00e2ff240cdd15fc984a6a2beb2b6fa55d
SHA512

7cafa2e523f8b71017eb11c43360840edabccd646696eaca3fbdd107562ed136a9e7244bd9469d273eee8d4c356308289ec35a83901f0a240d97c993d99cfe5e
SSDEEP

1536:P2Vu+dSbFTBJRc4gRGUUpZWpsDuPSwteQHB0:uVu+dSbBBLgRGlpSeT

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (15033) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
746	b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118
File opened for modification	/dev/misc/watchdog	b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	jp6wp72sfgds6inf	746	b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/tcp	b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118

/tmp/b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118
/tmp/b5b8d2636dc58fdc172091b3fcb0d865_JaffaCakes118
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
PID:746

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads