Overview

overview

7

Static

static

1

f0bc404f2a...kes118

ubuntu-18.04-amd64

7

f0bc404f2a...kes118

debian-9-armhf

7

f0bc404f2a...kes118

debian-9-mips

7

f0bc404f2a...kes118

debian-9-mipsel

7

Analysis

  • max time kernel
    10s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    21-09-2024 22:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118

  • Size

    1KB

  • MD5

    f0bc404f2a37988b3d9af5718e0058cc

  • SHA1

    ba254afebb83eaa1894f5fb8eec8aeced1420272

  • SHA256

    4e529958e608aea7f4a7916fc45e2dc475339b0e431227b5638e0ed330c50574

  • SHA512

    add92f394e29ad8f502462b1c34ea837b446ac36794e55a2956d39da10eb0140b7a66ad80bb632d1f0a3151ee19de388a1d423f4783041de3a7df07b25713e0b

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 13 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118
    /tmp/f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118
    1⤵
    • Writes file to tmp directory
    PID:649
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:657
    • /bin/cat
      cat ntpd
      2⤵
        PID:661
      • /bin/chmod
        chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
        2⤵
        • File and Directory Permissions Modification
        PID:664
      • /tmp/badbox
        ./badbox
        2⤵
        • Executes dropped EXE
        PID:665
      • /bin/cat
        cat sshd
        2⤵
          PID:670
        • /bin/chmod
          chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
          2⤵
          • File and Directory Permissions Modification
          PID:672
        • /tmp/badbox
          ./badbox
          2⤵
          • Executes dropped EXE
          PID:674
        • /bin/cat
          cat openssh
          2⤵
            PID:680
          • /bin/chmod
            chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
            2⤵
            • File and Directory Permissions Modification
            PID:682
          • /tmp/badbox
            ./badbox
            2⤵
            • Executes dropped EXE
            PID:684
          • /bin/cat
            cat bash
            2⤵
              PID:688
            • /bin/chmod
              chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
              2⤵
              • File and Directory Permissions Modification
              PID:691
            • /tmp/badbox
              ./badbox
              2⤵
              • Executes dropped EXE
              PID:692
            • /bin/cat
              cat tftp
              2⤵
                PID:695
              • /bin/chmod
                chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                2⤵
                • File and Directory Permissions Modification
                PID:696
              • /tmp/badbox
                ./badbox
                2⤵
                • Executes dropped EXE
                PID:698
              • /bin/cat
                cat wget
                2⤵
                  PID:702
                • /bin/chmod
                  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                  2⤵
                  • File and Directory Permissions Modification
                  PID:703
                • /tmp/badbox
                  ./badbox
                  2⤵
                  • Executes dropped EXE
                  PID:704
                • /bin/cat
                  cat cron
                  2⤵
                    PID:708
                  • /bin/chmod
                    chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                    2⤵
                    • File and Directory Permissions Modification
                    PID:710
                  • /tmp/badbox
                    ./badbox
                    2⤵
                    • Executes dropped EXE
                    PID:712
                  • /bin/cat
                    cat ftp
                    2⤵
                      PID:715
                    • /bin/chmod
                      chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                      2⤵
                      • File and Directory Permissions Modification
                      PID:716
                    • /tmp/badbox
                      ./badbox
                      2⤵
                      • Executes dropped EXE
                      PID:717
                    • /bin/cat
                      cat pftp
                      2⤵
                        PID:721
                      • /bin/chmod
                        chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                        2⤵
                        • File and Directory Permissions Modification
                        PID:722
                      • /tmp/badbox
                        ./badbox
                        2⤵
                        • Executes dropped EXE
                        PID:723
                      • /bin/cat
                        cat sh
                        2⤵
                          PID:726
                        • /bin/chmod
                          chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                          2⤵
                          • File and Directory Permissions Modification
                          PID:727
                        • /tmp/badbox
                          ./badbox
                          2⤵
                          • Executes dropped EXE
                          PID:729
                        • /bin/cat
                          cat " "
                          2⤵
                            PID:732
                          • /bin/chmod
                            chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                            2⤵
                            • File and Directory Permissions Modification
                            PID:733
                          • /tmp/badbox
                            ./badbox
                            2⤵
                            • Executes dropped EXE
                            PID:734
                          • /bin/cat
                            cat apache2
                            2⤵
                              PID:737
                            • /bin/chmod
                              chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                              2⤵
                              • File and Directory Permissions Modification
                              PID:738
                            • /tmp/badbox
                              ./badbox
                              2⤵
                              • Executes dropped EXE
                              PID:739
                            • /bin/cat
                              cat telnetd
                              2⤵
                                PID:742
                              • /bin/chmod
                                chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-0b16319dd34941349e3328a319fdfa60-systemd-timedated.service-Q1JGNq
                                2⤵
                                • File and Directory Permissions Modification
                                PID:743
                              • /tmp/badbox
                                ./badbox
                                2⤵
                                • Executes dropped EXE
                                PID:744

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • /tmp/busybox
                              Filesize

                              507KB

                              MD5

                              e588bcf03ae78237b58899d35f50c570

                              SHA1

                              2194732ebbefbc27bdae876c77f2a97a20175710

                              SHA256

                              2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88

                              SHA512

                              904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555

                              Download Submit