Analysis
-
max time kernel
149s -
max time network
148s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
18-09-2024 07:55
Behavioral task
behavioral1
Sample
e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
9 signatures
150 seconds
General
-
Target
e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118
-
Size
150KB
-
MD5
e8a797f0c211f49f06e39eaf4fd61c11
-
SHA1
68c5fc8ab1d172e35cd916f216962d65ad94147c
-
SHA256
f9fd50c34fb5a95cb6ed85a60a2935e2f6b18cdb6872da91f73c810abdf48cae
-
SHA512
1b5e7665eca7f9124de3ba08e7e169a9b3990b83921f3187b14780c2363120246841768e3e2295ce647e7dbe5e50305cebb028a88e40f73a00545d3d438c15e8
-
SSDEEP
3072:YfA8x4tQotpnpW4l5BLAgQkexp+5gRJUpjOhmN0sVhpzDkp0rN:OA7Ps4lDAgJI7It+mN0sVhpzDkp0rN
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for modification /dev/watchdog e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 149.61.53.0 Destination IP 61.53.0.0 Destination IP 144.217.149.61 Destination IP 144.217.149.61 Destination IP 217.149.61.53 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 -
Reads process memory 1 TTPs 22 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/790/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/825/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/580/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/582/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/778/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/782/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/418/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/439/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/457/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/575/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/823/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/833/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/891/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/432/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/728/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/729/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/761/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/792/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/508/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/509/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/746/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/789/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/dropbear 2489 e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 -
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/net/tcp e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 -
description ioc Process File opened for reading /proc/2190/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1092/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1397/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1956/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1974/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2086/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2122/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2137/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2308/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1055/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1396/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1693/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1777/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2009/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2010/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2245/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1121/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1339/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1889/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2131/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2493/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1933/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1990/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2001/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2008/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2318/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1690/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1952/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1966/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2195/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1061/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1921/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2142/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2213/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2220/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1254/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1950/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1996/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2012/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2284/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2491/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1785/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2005/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2007/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2150/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1068/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1926/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1968/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2237/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2486/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2178/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1045/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1054/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1082/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1123/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1798/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1805/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2127/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2253/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2485/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/2495/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1124/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1865/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118 File opened for reading /proc/1949/maps e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118
Processes
-
/tmp/e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes118/tmp/e8a797f0c211f49f06e39eaf4fd61c11_JaffaCakes1181⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system routing table
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:2489