52cc791bc03f7618fbcb679752d3858ea71f0a76f94feadb1126e97f3e38847b

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
28-08-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7573e1c671b34619b2cec043b882a98_JaffaCakes118
Size

1.2MB
MD5

c7573e1c671b34619b2cec043b882a98
SHA1

584c1890e6fb0686b2565f8bfdeff9cf14befaa7
SHA256

52cc791bc03f7618fbcb679752d3858ea71f0a76f94feadb1126e97f3e38847b
SHA512

a78b6648fb8e5d990f449577e0c31a5d998ea92e1ea5f9e75f7d189928cb3153e17abe24733c31089950778d5b54faee93bb895e6b0d813d50afa515697f1b21
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4/2y1q2rJp0:745vRVJKGtSA0VWeo+u9p0

Score

7^/10

rootkit

Malware Config

Signatures

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	2517	getty
/usr/bin/.sshd	2535	.sshd

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2476	c7573e1c671b34619b2cec043b882a98_JaffaCakes118
2478	Process not Found
2482	Process not Found
2478	Process not Found
2478	Process not Found
2484	Process not Found
2478	Process not Found
2478	Process not Found
2486	Process not Found
2478	Process not Found
2478	Process not Found
2488	Process not Found
2478	Process not Found
2478	Process not Found
2490	Process not Found
2478	Process not Found
2478	Process not Found
2509	Process not Found
2478	Process not Found
2478	Process not Found
2511	Process not Found
2478	Process not Found
2478	Process not Found
2513	Process not Found
2478	Process not Found
2515	Process not Found
2516	Process not Found
2517	getty
2515	Process not Found
2478	Process not Found
2519	Process not Found
2478	Process not Found
2478	Process not Found
2521	Process not Found
2478	Process not Found
2478	Process not Found
2523	Process not Found
2478	Process not Found
2518	Process not Found
2525	Process not Found
2518	Process not Found
2518	Process not Found
2527	Process not Found
2518	Process not Found
2518	Process not Found
2529	Process not Found
2518	Process not Found
2518	Process not Found
2531	Process not Found
2533	Process not Found
2534	Process not Found
2535	.sshd
2518	Process not Found
2518	Process not Found
2536	Process not Found
2518	Process not Found
2518	Process not Found
2538	Process not Found
2518	Process not Found
2518	Process not Found
2540	Process not Found
2518	Process not Found
2518	Process not Found
2542	Process not Found

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/ss	cp
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp
File opened for modification	/bin/lsof	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

/tmp/c7573e1c671b34619b2cec043b882a98_JaffaCakes118
/tmp/c7573e1c671b34619b2cec043b882a98_JaffaCakes118
1⤵
- Loads a kernel module
PID:2476
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:2483
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:2485
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:2487
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:2489
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:2491
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2510
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2512
- /usr/bin/cp
  cp -f /tmp/c7573e1c671b34619b2cec043b882a98_JaffaCakes118 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2514
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2517
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2526
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2528
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2530
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2532
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2537
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2539
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2541
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2543
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2545
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2547
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    PID:2549
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2551
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2553
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2555
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2557
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    PID:2559
- - /usr/bin/cp
    cp -f /bin/ss /usr/bin/dpkgd/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2561
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2563
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2565
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ss
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2567
- - /usr/bin/chmod
    chmod 0755 /bin/ss
    3⤵
    PID:2569
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2571
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2573
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2575
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    PID:2578
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2581
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2583
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2585
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    PID:2587
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2589
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2591
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2593
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ss
    3⤵
    PID:2595
- - /usr/sbin/insmod
    insmod /usr/bin/bsd-port/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2606
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2520
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2522
- /usr/bin/cp
  cp -f /tmp/c7573e1c671b34619b2cec043b882a98_JaffaCakes118 /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2524
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2535
- /usr/sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2597

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
3057dcde7b165778b228e2c974ca79b4

SHA1
24132d6323d2f4ea6b6f628fe459f828709ccdd9

SHA256
3ed58639e983fc7ff2ab4c2d35310ec318586ec7c6e07aa49a892c08a41b852c

SHA512
2c270a0552effcee9965ec99f5ccae02eba33bd0d3a31d59dd60cee23b1f250d710402306aac18d40b07646e92e8b14dfc7f229530c6ccef8a22d1f7199a7bba

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
53f0d7c537d99b3824f0f99d62ea2428

SHA1
fd036c77bc43059b0dfa9067039290b8f17440e5

SHA256
aabbb2bd43c0fb27462f139e0274faa6c3a5c6d600e1b2fc6d3c96c18503607e

SHA512
f934b9aec051382903f7bf391e6ea8d79771c4d95e804f47ee016b69985af5d651003595dda29c494ab592b0928dca406bdd56fc1352f5d471ab3b86f4dd9813

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
ef1e491a766ce3127556063d49bc2f98

SHA1
fae68e7aa157feaca2c3d7d05e99100d46d9ecfd

SHA256
1098335e95d32f09abf3519a886cb9774d4f668e694eb2835c473643618efc0e

SHA512
9da650b06a1f6332efb18ca9c583c6012974c3e177143a931cf92b11ad7d525b011fd636631d35ad256f35292d4eac6e534d8afd8618ca97148b932c92bc6771

Download Submit
/tmp/notify.file

Filesize
51B

MD5
87445675b09ba147f5b8b4ba562fc26d

SHA1
94d69fa774daed89793cec42a94795f0f31d3c55

SHA256
8f30caec3d3343294d8c7fdf220604432601e3849c4e5706267cbc470ea9bdd2

SHA512
cde93c900c9fb44e191db8bb115e96d1226f25fefd31e9d9273a1af0d637b50e22c2fc1c2bf5b41a3d7cc443da057f75bdcd6c9b326f8b6d077d4e6b3a6df3cd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads