d99e6c724f55505ed5a478a36e0a0ad18fadf94fb6215c78bf171d5da5553e25

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
08-09-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d52c6cadd4254a34c34095df93b2c195_JaffaCakes118
Size

1.2MB
MD5

d52c6cadd4254a34c34095df93b2c195
SHA1

4cba9953158f62bd2b12e06952ac81e3c3f1852e
SHA256

d99e6c724f55505ed5a478a36e0a0ad18fadf94fb6215c78bf171d5da5553e25
SHA512

0bf33847f71f5056af2de942431572e5f2c7ba81a3d4979e7865784ecc291aca6ca5439871a10dcfd5cec0165eae63fddaa0e38d70b72a42983046ad43af8a67
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4k2y1q2rJp0:745vRVJKGtSA0VWeoru9p0

Score

7^/10

defense_evasion discovery persistence rootkit

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2524	chmod
2534	chmod
2544	chmod
2554	chmod
2562	chmod
2570	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	2492	getty
/usr/bin/.sshd	2509	.sshd

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2451	d52c6cadd4254a34c34095df93b2c195_JaffaCakes118
2453	Process not Found
2468	Process not Found
2453	Process not Found
2453	Process not Found
2470	Process not Found
2453	Process not Found
2453	Process not Found
2472	Process not Found
2453	Process not Found
2453	Process not Found
2474	Process not Found
2453	Process not Found
2453	Process not Found
2476	Process not Found
2453	Process not Found
2453	Process not Found
2484	Process not Found
2453	Process not Found
2453	Process not Found
2486	Process not Found
2453	Process not Found
2453	Process not Found
2488	Process not Found
2453	Process not Found
2490	Process not Found
2491	Process not Found
2492	getty
2490	Process not Found
2453	Process not Found
2494	Process not Found
2453	Process not Found
2453	Process not Found
2496	Process not Found
2453	Process not Found
2453	Process not Found
2498	Process not Found
2453	Process not Found
2493	Process not Found
2500	Process not Found
2493	Process not Found
2493	Process not Found
2502	Process not Found
2493	Process not Found
2493	Process not Found
2504	Process not Found
2506	Process not Found
2507	Process not Found
2493	Process not Found
2493	Process not Found
2508	Process not Found
2509	.sshd
2493	Process not Found
2493	Process not Found
2511	Process not Found
2493	Process not Found
2493	Process not Found
2513	Process not Found
2493	Process not Found
2493	Process not Found
2515	Process not Found
2493	Process not Found
2493	Process not Found
2517	Process not Found

Write file to user bin folder 8 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/ss	cp
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp

Writes file to system bin folder 3 IoCs

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

/tmp/d52c6cadd4254a34c34095df93b2c195_JaffaCakes118
/tmp/d52c6cadd4254a34c34095df93b2c195_JaffaCakes118
1⤵
- Loads a kernel module
PID:2451
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:2469
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:2471
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:2473
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:2475
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:2477
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2485
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2487
- /usr/bin/cp
  cp -f /tmp/d52c6cadd4254a34c34095df93b2c195_JaffaCakes118 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2489
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2492
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2501
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2503
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2505
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2510
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2512
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2514
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2516
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2518
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2520
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2522
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2524
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2526
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2528
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2530
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2532
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2534
- - /usr/bin/cp
    cp -f /bin/ss /usr/bin/dpkgd/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2536
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2538
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2540
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ss
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2542
- - /usr/bin/chmod
    chmod 0755 /bin/ss
    3⤵
    - File and Directory Permissions Modification
    PID:2544
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2546
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2549
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2552
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2554
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2556
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2558
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2560
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2562
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2564
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2566
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2568
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ss
    3⤵
    - File and Directory Permissions Modification
    PID:2570
- - /usr/sbin/insmod
    insmod /usr/bin/bsd-port/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2582
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2495
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2497
- /usr/bin/cp
  cp -f /tmp/d52c6cadd4254a34c34095df93b2c195_JaffaCakes118 /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2499
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2509
- /usr/sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
c07c9f227030382e442b59f68ec0659b

SHA1
843c964e80a30930f2c6c7d5a9df750dc231598a

SHA256
9ec13b5388222b971e7d16781a4dce20d1589f6340843d07c5e72bd1bac3b1df

SHA512
59306c697965642435e468dba00d006599487719578c5dd8cec32b079449179106058d8d580db7668bbc3e285491da4a11b698fbac73a94f7dcffa4daae4f84c

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/conf.n

Filesize
73B

MD5
8643c633bba09aff9eb92d3d4cba27b2

SHA1
c14e2245b7d50e75d7fd115444d4eb9d941f4421

SHA256
84eb3c7bbc3297e9e49d908bae69f7b2bc79f03143d6d384214f6c763b2abeac

SHA512
b227185b40d09355f44de649963a5ee4bd88cfc6e3669466bc9e5e1c7779ba494472e64583601c7fc3b0cca74b3c87e1e2556152734dee787da33991e6b0c2f3

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
8c9f32e03aeb2e3000825c8c875c4edd

SHA1
caaa9552af2f6811278fe10f8f42beece2a72fdd

SHA256
3cb81c72e3c44a9c6a2fda94952ab34e0b0a89b0e7cfb6330ed371a0eda636bc

SHA512
0a8a03eff59f5db5abe8568bf5485b68a7458895b55084f788bec32bea00bfae8f35928726d3b2bca9d76ffb90fe00506f191004383d6ea78983294faf587331

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
86ecfcbc1e9f1ae5ee2d71910877da36

SHA1
55f21e37af5e8742143a8e69b2e15811d316de36

SHA256
c2d735ed61274b73ed20a49594661e35185797b6ee082cb5145383e548d4f9d0

SHA512
cd9e05cc4e86cc31dce0c27ab36ca3974d7ec8857a40d4bd04143b886c189b8ced08d06b7494871d335b59d9c018661809980f08514c5cf5d4099714c49ccebe

Download Submit
/tmp/notify.file

Filesize
51B

MD5
6e6a63e33211df12d76b29acfc0f5be8

SHA1
61eba6476f741840a115d4470e27aac026d6d536

SHA256
5cae63ea4cbd4a53817693038bfd8c4517875f152a3376ed3779605580a09983

SHA512
a8f6132b01a9880c362ae6be59e29579435700b91b302f2fd46494b131f7632cf10dd99328e499415540c8beb1ff266183115aa97f5d23ad49f91701ddd4b580

Download Submit