873fe8f1464c6e7a7f74ab8c1ea3c356a029d43a7a6a9de8eb5c887937234d11

Analysis

max time kernel
0s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18-09-2024 04:59

Target

e8609b5fe37bbc37ac72c127ab2a94e9_JaffaCakes118
Size

12KB
MD5

e8609b5fe37bbc37ac72c127ab2a94e9
SHA1

5cdbb385ff43a45b8da48208592031b0d211f17f
SHA256

873fe8f1464c6e7a7f74ab8c1ea3c356a029d43a7a6a9de8eb5c887937234d11
SHA512

0467c2fbaf0bee085fab4a12bd95d42db0fc9d0e88b79e5616799451fd4822d7bc878a4d319b64fcefe6cecac7b3507e5db3955d182a03368712f5e14742850c
SSDEEP

384:9MjVCXEXuK/WZDgD8AapX8XCkLWkWKzPKplKsNemW84mkXm+roosjh5oBq:xXEXeZDgD8AapX8XdLWk1zoIweb84mkU

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

flow	ioc
3	raw.githubusercontent.com
2	raw.githubusercontent.com

/tmp/e8609b5fe37bbc37ac72c127ab2a94e9_JaffaCakes118
/tmp/e8609b5fe37bbc37ac72c127ab2a94e9_JaffaCakes118
1⤵
PID:1479
- /usr/bin/clear
  clear
  2⤵
  PID:1480
- /bin/ping
  ping -c 1 raw.githubusercontent.com -i 1000
  2⤵
  PID:1481
- /bin/hostname
  hostname
  2⤵
  PID:1484
- /bin/uname
  uname -r
  2⤵
  PID:1486

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact