478e45caa33dd580e1b3805d84fffd190d9cee3635137ea1d3fc4220626519a7

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
22-09-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f134f8f0cdf87e2f3f4d9cbcc0f86b39_JaffaCakes118
Size

1.1MB
MD5

f134f8f0cdf87e2f3f4d9cbcc0f86b39
SHA1

584f15ff5f2188a25b8b27d96290c3550e4dffde
SHA256

478e45caa33dd580e1b3805d84fffd190d9cee3635137ea1d3fc4220626519a7
SHA512

faea0bbb90f6b0c84daf124c7db0cf1ef7fc1667e2636bab76ca06172fe930c0b6c363116338d4aa14a40b97a94e61b52f125a7ed76a2d51983078c24668c986
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfa2I+gIGYuuCol7r:4vREKfPqVE5jKsfa2RHGVo7r

Score

7^/10

defense_evasion discovery persistence rootkit

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2598	chmod
2577	chmod
2586	chmod
2592	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	2539	getty
/usr/bin/libsw	2547	libsw

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2499	f134f8f0cdf87e2f3f4d9cbcc0f86b39_JaffaCakes118
2500	Process not Found
2523	Process not Found
2500	Process not Found
2500	Process not Found
2525	Process not Found
2500	Process not Found
2500	Process not Found
2527	Process not Found
2500	Process not Found
2500	Process not Found
2529	Process not Found
2500	Process not Found
2500	Process not Found
2531	Process not Found
2500	Process not Found
2500	Process not Found
2533	Process not Found
2500	Process not Found
2500	Process not Found
2535	Process not Found
2500	Process not Found
2537	Process not Found
2538	Process not Found
2539	getty
2537	Process not Found
2500	Process not Found
2541	Process not Found
2500	Process not Found
2500	Process not Found
2543	Process not Found
2500	Process not Found
2545	Process not Found
2546	Process not Found
2547	libsw
2545	Process not Found
2500	Process not Found
2549	Process not Found
2500	Process not Found
2540	Process not Found
2557	Process not Found
2540	Process not Found
2540	Process not Found
2559	Process not Found
2540	Process not Found
2540	Process not Found
2562	Process not Found
2540	Process not Found
2540	Process not Found
2564	Process not Found
2540	Process not Found
2540	Process not Found
2566	Process not Found
2540	Process not Found
2540	Process not Found
2568	Process not Found
2540	Process not Found
2540	Process not Found
2570	Process not Found
2540	Process not Found
2540	Process not Found
2572	Process not Found
2540	Process not Found
2540	Process not Found

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/libsw	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir

/tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39_JaffaCakes118
/tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39_JaffaCakes118
1⤵
- Loads a kernel module
PID:2499
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:2524
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:2526
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:2528
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:2530
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:2532
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2534
- /usr/bin/cp
  cp -f /tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39_JaffaCakes118 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2536
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2539
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2558
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2560
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2563
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2565
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2567
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2569
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2571
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2573
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2575
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2577
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2580
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2582
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2584
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2586
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2588
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2590
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2592
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2594
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2596
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2598
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2600
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2542
- /usr/bin/cp
  cp -f /tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39_JaffaCakes118 /usr/bin/libsw
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2544
- /usr/bin/libsw
  /usr/bin/libsw
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2547
- /usr/sbin/insmod
  insmod /usr/lib/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2550

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
b64fe3ee133f95ffe33982c017598cfc

SHA1
558f11f7834fbfe3a411fd107d9f716b53373dcb

SHA256
85062335e891cb9573e36c257bf8726af6db888cecc9483d09d3807a6c8d5546

SHA512
216ff316de94c304f0b3bc9a4aa1518196870a0e14e49cd9475d797d82b48d601a5e3899643fd3748d3f0232cfcbb7dc8d4f2af759d9b263d2d85e728cc0fa1e

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lock

Filesize
4B

MD5
f7696a9b362ac5a51c3dc8f098b73923

SHA1
a6a0845258a40575703021e5244ff9c70838a23b

SHA256
5a0b83e19c5750eed6d8d46cb858d15c956a657093c08afa53133c0fbe5f04fb

SHA512
3ae0f24c4f1fe6593f20f92f251c54c1d10e6f576340c9ae31a46d50cf3b49c364d1a0ab6b9d5702cb057077db52a48f192b491f142315311629b9ad7cc11fdb

Download Submit
/tmp/moni.lock

Filesize
4B

MD5
0e4a2c65bdaddd66a53422d93daebe68

SHA1
42f3818ae19c5b7c9d44e9914c9cb15457c6fdc7

SHA256
299ae77a4ef350ae0dd37d6bba1c002d03444fb1edb236b341962dec14cb4bb4

SHA512
e34eab1d53ba0f20fe3a9a1f7f0201d2bcce230ad4b6d86e2e30754fdcd3d9fe24cc3f2d504ebcd9292ddbccc8f8224e28c9d929e80d7f10ed0451b229ef56e2

Download Submit
/tmp/notify.file

Filesize
51B

MD5
4b707cbe9bde01e43101645e20f91a61

SHA1
bed7fc7d4b2bedd87c11f22d2b04af612ec55c7c

SHA256
532a9f374ed8c0770130a37a710c1f782f33c1e62e8866e0e701d6ec5d605d91

SHA512
f6a17d02742e1df6a41d27923b1882819596a7d476ce9e41d690a26068d3e704066afae5e11490eeb38c1034d43c9867eaa16c1a0765a9ce7fb73705595e035d

Download Submit