Analysis
-
max time kernel
27s -
max time network
128s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
25/08/2024, 06:56
Behavioral task
behavioral1
Sample
c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118
Resource
ubuntu2204-amd64-20240611-en
General
-
Target
c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118
-
Size
54KB
-
MD5
c03021dbe86ef71f38ebd4e9ca99589e
-
SHA1
6a2d35ab8ae65a9a318f0a258bbf3a24924ccc44
-
SHA256
11502e7d9b312d3201fdcbe0f440d42cdbcf7403ef958b10fd6f397f01b18673
-
SHA512
e911ff42351e44f7605383b79718826d78e54b9095ca725aff611202b8bb8247764a23e9072f4d513db819876fb144119307941d73214ee3084cc4aac338ec7b
-
SSDEEP
768:R3HT2eWvuWYb3kfSzDrbrivF8NOpQ+EU/HYXH7WYdTZrtOfxcXjy:RDBWYb3uSzDPrivF8QbFg7WCTZrt+xc
Malware Config
Signatures
-
Contacts a large (4480) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 1568 c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118 File opened for modification /dev/misc/watchdog c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118 -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118 -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1568 c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp c03021dbe86ef71f38ebd4e9ca99589e_JaffaCakes118