Overview

overview

9

Static

static

7

e05239e298...kes118

debian-9-mips

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    e05239e2987c8157441eda363af15803_JaffaCakes118

  • Size

    52KB

  • Sample

    240914-q7j4raxere

  • MD5

    e05239e2987c8157441eda363af15803

  • SHA1

    2b110b96117b195f45615800ddd1a6461e7d7b16

  • SHA256

    3979a47b1e3e02652fc2e85e91912e98bbe3a86fecfc8efc6e1df3894c749776

  • SHA512

    52ad9626ce953b3b1f373e47999d8b7de8f0c4178d38354d7ba8abba5c60b7c0246ccc091e93f2e2546f5481b0a35cfa579222684bedda1d55f32697fc19b935

  • SSDEEP

    1536:IqxDFFJUmfZRFy1XtnjON4UPjfvVJuEQoxgdOD:IqxDFFJUmfZoBDUzvVQH5dG

Score
9/10
defense_evasiondiscoveryupx

Malware Config

Targets

    • Target

      e05239e2987c8157441eda363af15803_JaffaCakes118

    • Size

      52KB

    • MD5

      e05239e2987c8157441eda363af15803

    • SHA1

      2b110b96117b195f45615800ddd1a6461e7d7b16

    • SHA256

      3979a47b1e3e02652fc2e85e91912e98bbe3a86fecfc8efc6e1df3894c749776

    • SHA512

      52ad9626ce953b3b1f373e47999d8b7de8f0c4178d38354d7ba8abba5c60b7c0246ccc091e93f2e2546f5481b0a35cfa579222684bedda1d55f32697fc19b935

    • SSDEEP

      1536:IqxDFFJUmfZRFy1XtnjON4UPjfvVJuEQoxgdOD:IqxDFFJUmfZoBDUzvVQH5dG

    Score
    9/10
    defense_evasiondiscovery

    • Contacts a large (62289) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

      defense_evasion

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

      discovery

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks