Analysis
-
max time kernel
149s -
max time network
146s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
24-08-2024 04:16
Behavioral task
behavioral1
Sample
bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118
-
Size
48KB
-
MD5
bddf4fde60080788f93a03c96a18f7e1
-
SHA1
6281e69c770da5ff000e9509edeaf3540d733543
-
SHA256
c9fa423ccf0b66ec597999f9a3347094269f5815f6e55ab2e4996c9b6dedd9b1
-
SHA512
e21c15485329d898ef5a01ff35fb80e70ead5e0bf67c40f8b49915e82eb56bc1abc5f0c55975b7fceb30e4be015077b7446486e372f4c924133f96bb3fc04b44
-
SSDEEP
768:ZpkWWzNonwOTBgB6bP/r0gbFKTayWOrdKJD0DszGAc5y:ZkNonwOTBcWP/rHbFjyWOxKJD0DsSAc
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for modification /dev/misc/watchdog bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1568 bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/409/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/612/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/641/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1037/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1570/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/452/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/783/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/963/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/412/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1167/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/809/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1085/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1157/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1309/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1445/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/609/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1043/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1144/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/506/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1160/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1276/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1078/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/665/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/775/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/971/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1159/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1155/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1341/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/735/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1180/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1227/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1548/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/805/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/970/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1032/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1161/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/790/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1156/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1217/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1250/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1375/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/993/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1053/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1190/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/528/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/635/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/729/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/750/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/788/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1197/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/634/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/636/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1131/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1231/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1432/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/589/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/678/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1109/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1113/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1158/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1237/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1483/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/740/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118 File opened for reading /proc/1103/exe bddf4fde60080788f93a03c96a18f7e1_JaffaCakes118