4e529958e608aea7f4a7916fc45e2dc475339b0e431227b5638e0ed330c50574

Analysis

max time kernel
5s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21/09/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118
Size

1KB
MD5

f0bc404f2a37988b3d9af5718e0058cc
SHA1

ba254afebb83eaa1894f5fb8eec8aeced1420272
SHA256

4e529958e608aea7f4a7916fc45e2dc475339b0e431227b5638e0ed330c50574
SHA512

add92f394e29ad8f502462b1c34ea837b446ac36794e55a2956d39da10eb0140b7a66ad80bb632d1f0a3151ee19de388a1d423f4783041de3a7df07b25713e0b

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
766	chmod
779	chmod
785	chmod
795	chmod
752	chmod
759	chmod
773	chmod
790	chmod
800	chmod
745	chmod
736	chmod
805	chmod
727	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/badbox	729	badbox
/tmp/badbox	738	badbox
/tmp/badbox	747	badbox
/tmp/badbox	753	badbox
/tmp/badbox	760	badbox
/tmp/badbox	767	badbox
/tmp/badbox	774	badbox
/tmp/badbox	780	badbox
/tmp/badbox	786	badbox
/tmp/badbox	791	badbox
/tmp/badbox	796	badbox
/tmp/badbox	801	badbox
/tmp/badbox	806	badbox

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/badbox	f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118

/tmp/f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118
/tmp/f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:714
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/cat
  cat ntpd
  2⤵
  PID:724
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/cat
  cat sshd
  2⤵
  PID:734
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/cat
  cat openssh
  2⤵
  PID:743
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/cat
  cat bash
  2⤵
  PID:751
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/cat
  cat tftp
  2⤵
  PID:757
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/cat
  cat wget
  2⤵
  PID:764
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:767
- /bin/cat
  cat cron
  2⤵
  PID:771
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:774
- /bin/cat
  cat ftp
  2⤵
  PID:777
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/cat
  cat pftp
  2⤵
  PID:784
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/cat
  cat sh
  2⤵
  PID:789
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/cat
  cat " "
  2⤵
  PID:794
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/cat
  cat apache2
  2⤵
  PID:799
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/cat
  cat telnetd
  2⤵
  PID:804
- /bin/chmod
  chmod +x badbox busybox f0bc404f2a37988b3d9af5718e0058cc_JaffaCakes118 systemd-private-47ef9f21a13244f6a9028ae507250241-systemd-timedated.service-e0pkfk
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:806

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/busybox

Filesize
857KB

MD5
6ffc46165b5d9726a6607f3ea5305589

SHA1
ab127220f42e816b413dde0d17031e251a7bc98f

SHA256
80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c

SHA512
456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8

Download Submit