aec899c4b4433cbf3712fd7c9b07ca5da93a4ceceed234d088a8589853076474

Analysis

max time kernel
149s
max time network
153s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
30-08-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca7a6379aff2dbd02d3d776fe6b34401_JaffaCakes118
Size

1.2MB
MD5

ca7a6379aff2dbd02d3d776fe6b34401
SHA1

e94e00883093a0a90908f94c139f8fe897b0b75d
SHA256

aec899c4b4433cbf3712fd7c9b07ca5da93a4ceceed234d088a8589853076474
SHA512

7cfe2bf0b60f67f21a95fa929e95633d782c814e4028b22e9e34dba0fe981299b308af66bceb320de685b1ac1175269139818b701e50fc8dbd0c5eea58fed01e
SSDEEP

24576:e845rlHu6gVJKG75oFpA0VWiX4G2y1q2rJp0:745wRVJKGtSA0VWioVu9p0

Score

7^/10

rootkit

Malware Config

Signatures

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	2841	getty
/usr/bin/.sshd	2855	.sshd

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2817	ca7a6379aff2dbd02d3d776fe6b34401_JaffaCakes118
2822	Process not Found
2823	Process not Found
2822	Process not Found
2822	Process not Found
2825	Process not Found
2822	Process not Found
2822	Process not Found
2827	Process not Found
2822	Process not Found
2822	Process not Found
2829	Process not Found
2822	Process not Found
2822	Process not Found
2831	Process not Found
2822	Process not Found
2822	Process not Found
2833	Process not Found
2822	Process not Found
2822	Process not Found
2835	Process not Found
2822	Process not Found
2822	Process not Found
2837	Process not Found
2822	Process not Found
2839	Process not Found
2840	Process not Found
2841	getty
2839	Process not Found
2822	Process not Found
2843	Process not Found
2822	Process not Found
2822	Process not Found
2845	Process not Found
2822	Process not Found
2822	Process not Found
2847	Process not Found
2822	Process not Found
2842	Process not Found
2849	Process not Found
2842	Process not Found
2842	Process not Found
2851	Process not Found
2853	Process not Found
2854	Process not Found
2842	Process not Found
2842	Process not Found
2855	.sshd
2856	Process not Found
2842	Process not Found
2842	Process not Found
2858	Process not Found
2842	Process not Found
2842	Process not Found
2860	Process not Found
2842	Process not Found
2842	Process not Found
2862	Process not Found
2842	Process not Found
2842	Process not Found
2864	Process not Found
2842	Process not Found
2842	Process not Found
2866	Process not Found

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/ss	cp
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir

/tmp/ca7a6379aff2dbd02d3d776fe6b34401_JaffaCakes118
/tmp/ca7a6379aff2dbd02d3d776fe6b34401_JaffaCakes118
1⤵
- Loads a kernel module
PID:2817
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:2824
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:2826
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:2828
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:2830
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:2832
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2834
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2836
- /usr/bin/cp
  cp -f /tmp/ca7a6379aff2dbd02d3d776fe6b34401_JaffaCakes118 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2838
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2841
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2850
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2852
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2857
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2859
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2861
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2863
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2865
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2867
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2869
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2871
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    PID:2873
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2875
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2877
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2879
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2881
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    PID:2883
- - /usr/bin/cp
    cp -f /bin/ss /usr/bin/dpkgd/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2885
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2887
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2889
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ss
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2891
- - /usr/bin/chmod
    chmod 0755 /bin/ss
    3⤵
    PID:2893
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2895
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2897
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2899
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    PID:2901
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2903
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2905
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2907
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    PID:2909
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2911
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2913
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2915
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ss
    3⤵
    PID:2918
- - /usr/sbin/insmod
    insmod /usr/bin/bsd-port/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2923
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2844
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2846
- /usr/bin/cp
  cp -f /tmp/ca7a6379aff2dbd02d3d776fe6b34401_JaffaCakes118 /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2848
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2855
- /usr/sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2921

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
7b1f5dec3b6201672a71743c5cae10d8

SHA1
22604ddda0d9a3627cb825b990806288c42ffdaf

SHA256
3371b440857054685ba50a52809e0add36fda3e3781467c6806f0bc00fef53d2

SHA512
272e4a18782ffe769f8f5ea8b1e914bb26bc592a2393934abe4fd13aae0a9a9e1c7cd870b0ed00185f06819f2389252d3d9c84d89e1f96c4a11592914113a4ed

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/conf.n

Filesize
73B

MD5
d548338b1a9460cfb8021bb3c86c67ea

SHA1
90b4908151c4c6b52ae3fe2a69801653f0f6ec57

SHA256
f910856d85a3a8c3495bcc241de35b256243bf24f70d79f36aa6b4c3e2c52cdf

SHA512
b85837d49584b62e3a38e5c4246df83e6d9487d1b0e6ae7182f7cafc09b7cd2c2d82067c04127052b325f804025557d80af7f71793a86d08c73bae0e455c4786

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
0172d289da48c48de8c5ebf3de9f7ee1

SHA1
a0a9980a2b2b56651a64cd98df83af7670010128

SHA256
29923c8dc8abaca7ea7e4a08adefe252c74784a33ea0544a105c58dbb6c78607

SHA512
859343c90d9088f6398b9997b32678b8d54c73522fc4b9e99ff65aee65237cb4347133266f1eac6021b34fdcf2ba57b92214ee6466b6f9346040f8528f97a3b5

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
dfb84a11f431c62436cfb760e30a34fe

SHA1
4d8c3159b646e2e5ef74e09d741dab8ec1822ff0

SHA256
acec32b9a99f846cf042c33819d341da0e15c5f53871575274f055f23d37b365

SHA512
448876d38c571e0499fd455606081740f49c95c915bf411e1f61f60efbbc217be4b2f346896967e8bd21963edbba862476fed76fdfb1cfccb9c93059ebd8cbd6

Download Submit
/tmp/notify.file

Filesize
51B

MD5
1c8d8df3dfb4168c0e507f8fa2373711

SHA1
126808bc0201b1f4e9a72e8d39d2e465366df67f

SHA256
37c6158e7252db0fad8ded7561ebd16d6f09514aaaf647b42c15ff2995133295

SHA512
26835deaf68ed3b8de8b028ee073dac7b3cde61f40786076658c4d42f6d4dd830375a7b960839a78de190cb6222ed806f13e487edaebfaa0fb781000f6d784f4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads