7c5ecb1d56859abb82aea6c0bbbb3c541deadd8990f302af90a49215484e0731

Analysis

max time kernel
149s
max time network
153s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
29-08-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c95e67b69e594c42947710e0a920c303_JaffaCakes118
Size

1.2MB
MD5

c95e67b69e594c42947710e0a920c303
SHA1

2e3949d639b98f137b163345583b9f4796b01a13
SHA256

7c5ecb1d56859abb82aea6c0bbbb3c541deadd8990f302af90a49215484e0731
SHA512

fd0830caf8f2d151a8a0fc1180b06024b87671975647d646a983f3833669677d85f64d7d76308a432bbdd0685e0e2e601b0ab3bd1ebca170ff69d28db6509b73
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4y2y1q2rJp0:745vRVJKGtSA0VWeoBu9p0

Score

7^/10

rootkit

Malware Config

Signatures

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	2845	getty
/usr/bin/.sshd	2863	.sshd

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2821	c95e67b69e594c42947710e0a920c303_JaffaCakes118
2823	Process not Found
2827	Process not Found
2823	Process not Found
2823	Process not Found
2829	Process not Found
2823	Process not Found
2823	Process not Found
2831	Process not Found
2823	Process not Found
2823	Process not Found
2833	Process not Found
2823	Process not Found
2823	Process not Found
2835	Process not Found
2823	Process not Found
2823	Process not Found
2837	Process not Found
2823	Process not Found
2823	Process not Found
2839	Process not Found
2823	Process not Found
2823	Process not Found
2841	Process not Found
2823	Process not Found
2843	Process not Found
2844	Process not Found
2845	getty
2843	Process not Found
2823	Process not Found
2847	Process not Found
2823	Process not Found
2823	Process not Found
2849	Process not Found
2823	Process not Found
2823	Process not Found
2851	Process not Found
2823	Process not Found
2846	Process not Found
2853	Process not Found
2846	Process not Found
2846	Process not Found
2855	Process not Found
2846	Process not Found
2846	Process not Found
2857	Process not Found
2846	Process not Found
2846	Process not Found
2859	Process not Found
2860	Process not Found
2861	Process not Found
2863	.sshd
2846	Process not Found
2846	Process not Found
2864	Process not Found
2846	Process not Found
2846	Process not Found
2866	Process not Found
2846	Process not Found
2846	Process not Found
2868	Process not Found
2846	Process not Found
2846	Process not Found
2870	Process not Found

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/ss	cp
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

/tmp/c95e67b69e594c42947710e0a920c303_JaffaCakes118
/tmp/c95e67b69e594c42947710e0a920c303_JaffaCakes118
1⤵
- Loads a kernel module
PID:2821
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:2828
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:2830
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:2832
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:2834
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:2836
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2838
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2840
- /usr/bin/cp
  cp -f /tmp/c95e67b69e594c42947710e0a920c303_JaffaCakes118 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2842
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2845
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2854
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2856
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2858
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2862
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2865
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2867
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2869
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2871
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2873
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2875
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    PID:2877
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2879
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2881
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2883
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2885
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    PID:2887
- - /usr/bin/cp
    cp -f /bin/ss /usr/bin/dpkgd/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2889
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2891
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2893
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ss
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2895
- - /usr/bin/chmod
    chmod 0755 /bin/ss
    3⤵
    PID:2897
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2899
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2901
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2903
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    PID:2905
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2907
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2909
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2911
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    PID:2913
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2915
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2917
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2919
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ss
    3⤵
    PID:2922
- - /usr/sbin/insmod
    insmod /usr/bin/bsd-port/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2927
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2848
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2850
- /usr/bin/cp
  cp -f /tmp/c95e67b69e594c42947710e0a920c303_JaffaCakes118 /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2852
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2863
- /usr/sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2925

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
3616f66475f0c07f3d954a445bd67eea

SHA1
2440f1a8143ce80b9950a95b9ef34962c10e7134

SHA256
e66425d10d92153bdbe1ca98c3d80d9e3e32140d5e240ec0f3759ce79f183d50

SHA512
3ea5e97fafb7053927aba320b7d82d316853ce408c92456951d792e652dafdcc8b8f490e83689d9a3e0296e8e899c7887d9270c7799d26991eb874a41e885e2c

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
46f76a4bda9a9579eab38a8f6eabcda1

SHA1
2863d7ae605104eeef364e3f164d3404e20f680c

SHA256
bfaa492bc1eb6c25c1e676ff0f4bab292e725a5cc3290f0a6d58750439d12f10

SHA512
98de239778efbdc16581b101337fb5403327f03f108fbcda489aad095df78e6fa100fa43b0ab2f88612ad842aabcae626a45e0e911afa411a7154aae7c9fe37e

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
465636eb4a7ff4b267f3b765d07a02da

SHA1
2fb957b813146e5b1e16439b82f80f7711e6f051

SHA256
b72b9e445e2cda580ee6157ac2d46a1d6683a42d94de92256ffbcfd7f3803949

SHA512
f7305685476b597beb9dee21b12e829269b8f5691d9e3dcffd708fbc1d75fb4f3046317381326c40dd2a8afdf3e8d44d0c1ba132ff21c1493f2194351ed1934d

Download Submit
/tmp/notify.file

Filesize
51B

MD5
4a3cc41015d8b9be12453ef64bd28ab0

SHA1
15684c26ff9211fcafea649ee84b21e710ec9c14

SHA256
4f6f28573e6e5c9bc57a85998fb26c97cfa55da8ed2222d20f5d48dba2df4468

SHA512
d76e007d07d5ea530a627e73a0d630d0cd84d77f4bae166e47b9eac0f8c6de6ae7f4322b0be3b9996e20871dcb6a2def7ca1f5f851ca5d1c3303f87e0f3ee233

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
73B

MD5
a56ed232b9c8c6fb177ce6ddc296442d

SHA1
f897aa082afea034f39bec49514c85458a830317

SHA256
bfecefbf08b252d65387c94d9bc339d216eefe6b9b5bab2386e399e1c071cbc6

SHA512
e1fe4f968b8cc9d539b9c73903c1b0d5b79bc83bac6f000f1b3d1d89f7854296826c672ecc9bdff5612b17e80dbc6165efaa19d5c55adf015b3db0a997743b75

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads