1c41c82bdbcea4eb23cde97b947e5a32a8a08511588780b0e3285f65a7ce2578

Analysis

max time kernel
5s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21-09-2024 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118
Size

1KB
MD5

ef74797ed93ffcc0506a4be0bf2fc3d8
SHA1

df1af944cc6d2f580e879f7ffb5d902704728c46
SHA256

1c41c82bdbcea4eb23cde97b947e5a32a8a08511588780b0e3285f65a7ce2578
SHA512

bf357fc02eeaa20a920d66d3e981aadddc45ec004fd31b72f34d020626cbfa5bcf57b72c12ac0db47b1e88d38d076e41d9dbad165d9e8ab86552a12c23a34a4d

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
790	chmod
754	chmod
731	chmod
762	chmod
769	chmod
780	chmod
795	chmod
723	chmod
748	chmod
775	chmod
800	chmod
740	chmod
785	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/badbox	725	badbox
/tmp/badbox	733	badbox
/tmp/badbox	742	badbox
/tmp/badbox	749	badbox
/tmp/badbox	756	badbox
/tmp/badbox	764	badbox
/tmp/badbox	770	badbox
/tmp/badbox	776	badbox
/tmp/badbox	781	badbox
/tmp/badbox	786	badbox
/tmp/badbox	791	badbox
/tmp/badbox	796	badbox
/tmp/badbox	801	badbox

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/badbox	ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118

/tmp/ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118
/tmp/ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118
1⤵
- Writes file to tmp directory
PID:709
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:712
- /bin/cat
  cat ntpd
  2⤵
  PID:720
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/cat
  cat sshd
  2⤵
  PID:729
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/cat
  cat openssh
  2⤵
  PID:738
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/cat
  cat bash
  2⤵
  PID:747
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/cat
  cat tftp
  2⤵
  PID:752
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/cat
  cat wget
  2⤵
  PID:759
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:764
- /bin/cat
  cat cron
  2⤵
  PID:768
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/cat
  cat ftp
  2⤵
  PID:774
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/cat
  cat pftp
  2⤵
  PID:779
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/cat
  cat sh
  2⤵
  PID:784
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/cat
  cat " "
  2⤵
  PID:789
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/cat
  cat apache2
  2⤵
  PID:794
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/cat
  cat telnetd
  2⤵
  PID:799
- /bin/chmod
  chmod +x badbox busybox ef74797ed93ffcc0506a4be0bf2fc3d8_JaffaCakes118 systemd-private-970d4248598c46f996a9e6a2a2b31f98-systemd-timedated.service-FEvk9V
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/badbox
  ./badbox
  2⤵
  - Executes dropped EXE
  PID:801

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/busybox

Filesize
857KB

MD5
6ffc46165b5d9726a6607f3ea5305589

SHA1
ab127220f42e816b413dde0d17031e251a7bc98f

SHA256
80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c

SHA512
456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8

Download Submit