26e626872e082d2c3f713889e1c2dbbe077843d977950cc12ba8658f5ee0e33a

Analysis

max time kernel
5s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
23/08/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118
Size

77KB
MD5

ba9a8fd1b62b9d87224d171c2e3be0fd
SHA1

489e7e3600ee60348849f8922a8e428f117aee7e
SHA256

26e626872e082d2c3f713889e1c2dbbe077843d977950cc12ba8658f5ee0e33a
SHA512

d7b5e6cf3fa4895ef90d0e60e3f2c8a095b7e2504202458a8caf348661e397ba1d3b71b4520e5fb816f12e7a9a4a95e06de4601140b3d5f2dc8eae248b945ce2
SSDEEP

1536:J4gZLUay6+vl/Q15k9YrE9x5EZYg0TWNJ7DWTGmjJv09:Wmry6+vd2k9YrEsDJ7DWTGkJ89

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
703	ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118
File opened for modification	/dev/misc/watchdog	ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/tcp	ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118

/tmp/ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118
/tmp/ba9a8fd1b62b9d87224d171c2e3be0fd_JaffaCakes118
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system network configuration
PID:703

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...