Analysis

  • max time kernel
    27s
  • max time network
    128s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    25/08/2024, 06:56

General

  • Target

    c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118

  • Size

    54KB

  • MD5

    c03021dbe86ef71f38ebd4e9ca99589e

  • SHA1

    6a2d35ab8ae65a9a318f0a258bbf3a24924ccc44

  • SHA256

    11502e7d9b312d3201fdcbe0f440d42cdbcf7403ef958b10fd6f397f01b18673

  • SHA512

    e911ff42351e44f7605383b79718826d78e54b9095ca725aff611202b8bb8247764a23e9072f4d513db819876fb144119307941d73214ee3084cc4aac338ec7b

  • SSDEEP

    768:R3HT2eWvuWYb3kfSzDrbrivF8NOpQ+EU/HYXH7WYdTZrtOfxcXjy:RDBWYb3uSzDPrivF8QbFg7WCTZrt+xc

Score
9/10

Malware Config

Signatures

  • Contacts a large (4480) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Deletes itself 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

Processes

  • /tmp/c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118
    /tmp/c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118
    1⤵
    • Deletes itself
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Changes its process name
    • Reads system network configuration
    PID:1568

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads