Analysis
-
max time kernel
149s -
max time network
144s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
-
submitted
06-09-2024 07:53
General
-
Target
cf0c9c132a13a3097012530bb312afee_JaffaCakes118
-
Size
1.1MB
-
MD5
cf0c9c132a13a3097012530bb312afee
-
SHA1
bf196eaa6b0c90a3ef45b81ada29eded7e6031d9
-
SHA256
3c1daabc22d5f5c1639c4b43ab9c8cb3f81b720931d71045ab702d54adc6555f
-
SHA512
f4d28ca9d0ec69de01e1a65596e485a39d5bf38d7ad4689a8c829890d263cafde25c73a683750b6296ae5a07228ba8104ab9b5d31f4bd4b1aafbe8f8d45d3bbf
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfalI+gIGYuuCol7r:4vREKfPqVE5jKsfalRHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 32 IoCs
-
Modifies init.d 2 TTPs 17 IoCs
Adds/modifies system service, likely for persistence.
-
Reads system routing table 1 TTPs 16 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Write file to user bin folder 64 IoCs
-
Checks CPU configuration 1 TTPs 16 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads system network configuration 1 TTPs 48 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/cf0c9c132a13a3097012530bb312afee_JaffaCakes118/tmp/cf0c9c132a13a3097012530bb312afee_JaffaCakes1181⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Writes file to tmp directory
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"2⤵
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt3⤵
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"2⤵
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt3⤵
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"2⤵
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt3⤵
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"2⤵
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt3⤵
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"2⤵
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt3⤵
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /tmp/cf0c9c132a13a3097012530bb312afee_JaffaCakes118 /usr/bin/bsd-port/systm"2⤵
-
/usr/bin/cpcp -f /tmp/cf0c9c132a13a3097012530bb312afee_JaffaCakes118 /usr/bin/bsd-port/systm3⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm2⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm3⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"4⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port5⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"4⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm5⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm4⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm5⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"6⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port7⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"6⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm7⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm6⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm7⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"8⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port9⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"8⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm9⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm8⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm9⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"10⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port11⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"10⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm11⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm10⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm11⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"12⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port13⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"12⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm13⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm12⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm13⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"14⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port15⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"14⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm15⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm14⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm15⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"16⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port17⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"16⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm17⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm16⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm17⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"18⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port19⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"18⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm19⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm18⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm19⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"20⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port21⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"20⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm21⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm20⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm21⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"22⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port23⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"22⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm23⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm22⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm23⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"24⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port25⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"24⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm25⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm24⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm25⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"26⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port27⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"26⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm27⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm26⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm27⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"28⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port29⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"28⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm29⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm28⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm29⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"30⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port31⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"30⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm31⤵
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm30⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm31⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"32⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port33⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"32⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm33⤵
-
-
-
/bin/shsh -c /usr/bin/bsd-port/systm32⤵
-
/usr/bin/bsd-port/systm/usr/bin/bsd-port/systm33⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Writes file to tmp directory
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"34⤵
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port35⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm"34⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/bsd-port/systm35⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"32⤵
-
/usr/bin/mkdirmkdir -p /usr/bin33⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"32⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno33⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno32⤵
-
/usr/bin/pythno/usr/bin/pythno33⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"32⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko33⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"30⤵
-
/usr/bin/mkdirmkdir -p /usr/bin31⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"30⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno31⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno30⤵
-
/usr/bin/pythno/usr/bin/pythno31⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"30⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko31⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"28⤵
-
/usr/bin/mkdirmkdir -p /usr/bin29⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"28⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno29⤵
- Write file to user bin folder
-
-
-
/bin/shsh -c /usr/bin/pythno28⤵
-
/usr/bin/pythno/usr/bin/pythno29⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"28⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko29⤵
- Reads runtime system information
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"26⤵
-
/usr/bin/mkdirmkdir -p /usr/bin27⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"26⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno27⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno26⤵
-
/usr/bin/pythno/usr/bin/pythno27⤵
- Executes dropped EXE
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"26⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko27⤵
- Reads runtime system information
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"24⤵
-
/usr/bin/mkdirmkdir -p /usr/bin25⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"24⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno25⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno24⤵
-
/usr/bin/pythno/usr/bin/pythno25⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"24⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko25⤵
- Reads runtime system information
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"22⤵
-
/usr/bin/mkdirmkdir -p /usr/bin23⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"22⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno23⤵
- Write file to user bin folder
-
-
-
/bin/shsh -c /usr/bin/pythno22⤵
-
/usr/bin/pythno/usr/bin/pythno23⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"22⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko23⤵
- Reads runtime system information
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"20⤵
-
/usr/bin/mkdirmkdir -p /usr/bin21⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"20⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno21⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno20⤵
-
/usr/bin/pythno/usr/bin/pythno21⤵
- Executes dropped EXE
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"20⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko21⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"18⤵
-
/usr/bin/mkdirmkdir -p /usr/bin19⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"18⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno19⤵
- Write file to user bin folder
-
-
-
/bin/shsh -c /usr/bin/pythno18⤵
-
/usr/bin/pythno/usr/bin/pythno19⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"18⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko19⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"16⤵
-
/usr/bin/mkdirmkdir -p /usr/bin17⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"16⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno17⤵
- Write file to user bin folder
-
-
-
/bin/shsh -c /usr/bin/pythno16⤵
-
/usr/bin/pythno/usr/bin/pythno17⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"16⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko17⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"14⤵
-
/usr/bin/mkdirmkdir -p /usr/bin15⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"14⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno15⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno14⤵
-
/usr/bin/pythno/usr/bin/pythno15⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"14⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko15⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"12⤵
-
/usr/bin/mkdirmkdir -p /usr/bin13⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"12⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno13⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno12⤵
-
/usr/bin/pythno/usr/bin/pythno13⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"12⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko13⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"10⤵
-
/usr/bin/mkdirmkdir -p /usr/bin11⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"10⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno11⤵
- Write file to user bin folder
-
-
-
/bin/shsh -c /usr/bin/pythno10⤵
-
/usr/bin/pythno/usr/bin/pythno11⤵
- Executes dropped EXE
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"10⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko11⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"8⤵
-
/usr/bin/mkdirmkdir -p /usr/bin9⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"8⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno9⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno8⤵
-
/usr/bin/pythno/usr/bin/pythno9⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"8⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko9⤵
- Reads runtime system information
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"6⤵
-
/usr/bin/mkdirmkdir -p /usr/bin7⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"6⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno7⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno6⤵
-
/usr/bin/pythno/usr/bin/pythno7⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"6⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko7⤵
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/systm /usr/bin/pythno"4⤵
-
/usr/bin/cpcp -f /usr/bin/bsd-port/systm /usr/bin/pythno5⤵
- Write file to user bin folder
- Reads runtime system information
-
-
-
/bin/shsh -c /usr/bin/pythno4⤵
-
/usr/bin/pythno/usr/bin/pythno5⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"4⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko5⤵
- Reads runtime system information
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
-
-
-
/bin/shsh -c "cp -f /tmp/cf0c9c132a13a3097012530bb312afee_JaffaCakes118 /usr/bin/pythno"2⤵
-
/usr/bin/cpcp -f /tmp/cf0c9c132a13a3097012530bb312afee_JaffaCakes118 /usr/bin/pythno3⤵
- Write file to user bin folder
-
-
-
/bin/shsh -c /usr/bin/pythno2⤵
-
/usr/bin/pythno/usr/bin/pythno3⤵
- Executes dropped EXE
- Writes file to tmp directory
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"2⤵
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD5d3d8e718a08f3e10ab2ed52c3cedea01
SHA16090372e5a89f39111825d9692988a3544473991
SHA256ff09c451d0f3c5f27282fc550e63c5bda9a1701cf54a610df3cbabc0584c42ba
SHA51213a4a807483b3f4f5319166062ff2cb39e20ea11732fb881fe71cbe3df165070b162b85edb8834860e19afdca5ea939b17c2ee175b8ad91bf86e2d0f18851d5c
-
Filesize
64B
MD5b8529bfabe29dbf05859885133d39fd7
SHA13104b0c2b52c20dc027f88638bbfc2094b624623
SHA2569e72426a5cb3d15539b5a9b2b29f74f98931db6f94b3d6f3820805a8e1758591
SHA5123fd93a02120423652e434f6c77bfec69899b4f1dedfdfca34108dfdfae1bd7a601f2d38b26689b7568e0e9f1555a568542b8e7806e92dd0ec317618bc68662d2
-
Filesize
69B
MD5227856889c50184308123071d54e9a8c
SHA1ef1f44f44c1b9cda768cedbf085d984fac1094c0
SHA256842f3c609faab1be3d68bf9e9e6fd594be0057450988cc00274c0d8ed5b14345
SHA512edc405aa41c9bb428455d737bf4e57b3a735a80aafd935b7cdbae0da2f3dc5126e3eb8396b2fe22e1f1680550e9c23830a7214c9ab98e2dde5b9c268d18c9243
-
Filesize
4B
MD5c7af0926b294e47e52e46cfebe173f20
SHA1948b13c7ba369f02fc29d936c124689877023958
SHA2566d7be37d6aa3665ddca5b4c3ab26e689e4efc1c33bea69ccbaeec6ed49569558
SHA51284ff72624f10220c6960fc1d0fe9bbdd329bdc5b8eeef36d8b31d9f3b78f050f11d21b67839576982d1aa87312a1c19e075d284f7b13d28d87631735d73310e6
-
Filesize
4B
MD57437d136770f5b35194cb46c1653efaa
SHA1fcc78b5fcb5a7d9ea7f3b136af0efd88bc24500b
SHA256a16c0ab260e30b22cd06fadf9a6a30c454ddc845925cc831796b2988874d6a5a
SHA5121e66aa2b6d9287080dde2826252b5df22e7cf9cdf726f92226cf5982f1f362712e7c77f5629398f4a11e61524836044fa0aa4135e5a73834b3eab8d3b5d6c909
-
Filesize
4B
MD5831c2f88a604a07ca94314b56a4921b8
SHA1e4fb11694cd7bab54173d1d9664eb70b6b6b8a14
SHA256df6822cd01387e05c8ea01eae408dacae839ebf27c2ce1ffa3b6a0b7f3f0ffa1
SHA51210a3f9ea81f15a045197d0afa900930081489c363acb934d7aa3125c1f32540dea17e0d47612a70fcf3707c35573372033214ffdb9314e5c636a2d0f45920a9d
-
Filesize
4B
MD506964dce9addb1c5cb5d6e3d9838f733
SHA12cfe534aa66900e81f6f20b02826b6132d2df8de
SHA2560985b889a1fe4f4e1fb925061ac6fb2247f10875f5fcbe63eec2ab55ed68970e
SHA512106d8c285b8d4ce4f095ef7cb89c0a4b1c5c2797187c54c3407db19fc505a59f89250d5546c62f9de9e82cf69f0c524e57325f424a5c2a975c4e75c1dc175171
-
Filesize
4B
MD5309fee4e541e51de2e41f21bebb342aa
SHA1ee8abc188469df780d869b862fde433a2327678e
SHA256a19fbf8bf0530ca46179b803a8234f56276f21c0e7dc2f84c682924b95de5801
SHA5123fb050c47892b04da1c6021ebb875e271716d181db95965a26350151429613e986e7c7e26060ecd2cb508f5492ba655a52ccba8b2f95a0c88237553165fe8971
-
Filesize
23B
MD56ac315e05e2c546cbfc7377183868dbb
SHA1c813c277a22442e2e4eda52d458d357cb2165bdc
SHA2568ae13b41755e857e5dee9e7089151678a8f47c57a6dfa11de267ec551bd4fc7a
SHA512cdd7c48f082f0c59698aa1da7bc41749468d17e1b1de51922adc2966b12d3424035543d9479919ab96694c36d78081181e4777e924d7901a3c1e49db6095eefa
-
Filesize
51B
MD5b2fc2dcf4e3d411aed21e9ae7bfe3b2f
SHA18dc442e445abcbb987636119261e85645d1713dc
SHA2565eea9f1b8dc7fade154a5432266090455bca402d9ca2efa929be4060f640e589
SHA512fc438e1fafa3c0ce5b807319a2b61047ebe47d180ca688ee7c68f1ac84197c642621b9aedc39f22b36aabaa55082a45d1eb07974ce5d86f4a138ffc1a0df1d4f
-
Filesize
4B
MD5894b77f805bd94d292574c38c5d628d5
SHA11784f0e37c1fdd6200c1e8b28e8caae5402e74e0
SHA256d24eac45e69be063cc0053eb02650954eec62c314c405e564a4d11e951392e75
SHA512605b8ee18c6bd7c9d489faa803dc4c00fed6e7a4b21a9a69ba7b429642a06d7fe42e5fd45162f72fff76f1ec518c5840399c97d4ab0f7633651d35e2b19f2e05
-
Filesize
4B
MD5e9fd7c2c6623306db59b6aef5c0d5cac
SHA123bfd8a26fdeaa0ccf8a0b3f8705506064a99ba0
SHA256583b08e38c98f4350a8906d25344ac80b099921a8a8929e64b2dc2b553521343
SHA5120d19563eb4d989fdbdbe9250ef2c8856bcca196bcbff66c21a564f5da3f6270cb3040997d04abbf7e4a2ded7bae5160119471ab541604c0e7696422dd9d80d32
-
Filesize
4B
MD5be53ee61104935234b174e62a07e53cf
SHA1150afba2f606bf3e450d7dbfba16c6673580cb77
SHA256a9ffbdf317b2dabf198f59653da551149ad51173b2014ae1df5d183c2ddfcf26
SHA512be6aab77ff13b95b184c78f1e5fd75e661c1d5817b96d9c914f32e016ce9de260423934e48ec592bc8a0caf5f39e79fb584be0f779fe51c4b991afde8b623428
-
Filesize
4B
MD584f0f20482cde7e5eacaf7364a643d33
SHA189d89e5773c4210782aa5783b7dfba5e0af85ccc
SHA256cdbe4e7e26e3a55307dac9da65edc0d33fa6b54f79a83373cb997770856c23bd
SHA5120cbd9735e463305a3833f113c0d5669a601cbec557f42fca9d5179908ceb3f233876bd9519dbea4adbc9fd75f537bd2cabda86b1776e196d9bf1d92f54ffaaed
-
Filesize
4B
MD54a3e00961a08879c34f91ca0070ea2f5
SHA13d7b4f23b8f853910e4c64f09cdf897a59db524a
SHA2569113b98df80f877c7a2ee5d865a04c9514b4e9bf25a49d315b0b15f115d2f0d2
SHA512d1f2ce8c63117858895e34c65a83ae4e16e21026cb12e15abeeeacbd3b140a80509d23937aea6577e4605ec770cf48dfbe7b923a972c7fd4cb98ffb128019e95
-
Filesize
1.1MB
MD5cf0c9c132a13a3097012530bb312afee
SHA1bf196eaa6b0c90a3ef45b81ada29eded7e6031d9
SHA2563c1daabc22d5f5c1639c4b43ab9c8cb3f81b720931d71045ab702d54adc6555f
SHA512f4d28ca9d0ec69de01e1a65596e485a39d5bf38d7ad4689a8c829890d263cafde25c73a683750b6296ae5a07228ba8104ab9b5d31f4bd4b1aafbe8f8d45d3bbf