2d4129a21494cbb8bb2846b39266bf4e15accd20aca97ecaff664a363ddd50bc

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
22-09-2024 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f197672395432b1cca10bb2324f8bbb0_JaffaCakes118
Size

1.1MB
MD5

f197672395432b1cca10bb2324f8bbb0
SHA1

14244002684fea5883200559d825dc4f6bc09072
SHA256

2d4129a21494cbb8bb2846b39266bf4e15accd20aca97ecaff664a363ddd50bc
SHA512

5ab9b5769c0c9b3527bd1bd931cb25ce378823a57760240c7d70a454a0aab1fc3d8ac7094d0603623cc3f9c27e5659825060b2adaa7885039b94f7a198e947c5
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfanI+gIGYuuCol7r:4vREKfPqVE5jKsfanRHGVo7r

Score

7^/10

defense_evasion discovery persistence rootkit

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2563	chmod
2542	chmod
2551	chmod
2557	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/knerl	2504	knerl
/usr/bin/pythno	2512	pythno

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2464	f197672395432b1cca10bb2324f8bbb0_JaffaCakes118
2465	Process not Found
2482	Process not Found
2465	Process not Found
2465	Process not Found
2484	Process not Found
2465	Process not Found
2465	Process not Found
2486	Process not Found
2465	Process not Found
2465	Process not Found
2488	Process not Found
2465	Process not Found
2465	Process not Found
2490	Process not Found
2465	Process not Found
2465	Process not Found
2498	Process not Found
2465	Process not Found
2465	Process not Found
2500	Process not Found
2465	Process not Found
2502	Process not Found
2503	Process not Found
2504	knerl
2502	Process not Found
2465	Process not Found
2506	Process not Found
2465	Process not Found
2465	Process not Found
2508	Process not Found
2465	Process not Found
2510	Process not Found
2511	Process not Found
2512	pythno
2510	Process not Found
2465	Process not Found
2514	Process not Found
2465	Process not Found
2505	Process not Found
2519	Process not Found
2505	Process not Found
2505	Process not Found
2522	Process not Found
2505	Process not Found
2505	Process not Found
2525	Process not Found
2505	Process not Found
2505	Process not Found
2528	Process not Found
2505	Process not Found
2505	Process not Found
2531	Process not Found
2505	Process not Found
2505	Process not Found
2533	Process not Found
2505	Process not Found
2505	Process not Found
2535	Process not Found
2505	Process not Found
2505	Process not Found
2537	Process not Found
2505	Process not Found
2505	Process not Found

Write file to user bin folder 6 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/bsd-port/knerl	cp
File opened for modification	/usr/bin/pythno	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

/tmp/f197672395432b1cca10bb2324f8bbb0_JaffaCakes118
/tmp/f197672395432b1cca10bb2324f8bbb0_JaffaCakes118
1⤵
- Loads a kernel module
PID:2464
- /usr/bin/ln
  ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
  2⤵
  PID:2483
- /usr/bin/ln
  ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
  2⤵
  PID:2485
- /usr/bin/ln
  ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
  2⤵
  PID:2487
- /usr/bin/ln
  ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
  2⤵
  PID:2489
- /usr/bin/ln
  ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
  2⤵
  PID:2491
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2499
- /usr/bin/cp
  cp -f /tmp/f197672395432b1cca10bb2324f8bbb0_JaffaCakes118 /usr/bin/bsd-port/knerl
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2501
- /usr/bin/bsd-port/knerl
  /usr/bin/bsd-port/knerl
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2504
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2520
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2524
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2527
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2529
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2532
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2534
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2536
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2538
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/knerl /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2540
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2542
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2544
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2547
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/knerl /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2549
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2551
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2553
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2555
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2557
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2559
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/knerl /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2561
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2563
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2565
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2507
- /usr/bin/cp
  cp -f /tmp/f197672395432b1cca10bb2324f8bbb0_JaffaCakes118 /usr/bin/pythno
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2509
- /usr/bin/pythno
  /usr/bin/pythno
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2512
- /usr/sbin/insmod
  insmod /usr/lib/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2515

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/VsystemsshMdt

Filesize
64B

MD5
40b78cc69f5a5384274e08000360eb82

SHA1
2b299ce0b515c00a01af23a366cae01f7fc69b0b

SHA256
e9dbfaba79d66095a3e02825d85de96066ea71073f011d391661f1e2dadcb3a2

SHA512
bed78fe156ed18684fff2fcde62bcb9ab579110620076ad7658394dfae62971397a29deb75c3f4665443064ff836ba354af45c9bfc99093aa30716b0480076ed

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
caa27b819c9303446f702929874a00e8

SHA1
d24199c0e376edea3f822b215148cc0dc78364bf

SHA256
da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

SHA512
dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

Download Submit
/tmp/idus.log

Filesize
4B

MD5
84b20b1f5a0d103f5710bb67a043cd78

SHA1
6286b52ae81a4481bb77caf4d35139764e32d0c8

SHA256
479f8ec909fe2e84ad23cb8a55e3fc41bc84659e81be514db4b989a89a9bd2a0

SHA512
872205d00ae9b4d75c687abd62636954f7ebcc4f6065e8c61f5b069a433648d5b678739e0fb44e8e7bdd32d6306044a8254fa44760ccef65d95ebe33d0d59528

Download Submit
/tmp/notify.file

Filesize
51B

MD5
f6c5a5e3fbd42ebe3698d77d3ae0d528

SHA1
1a689d44d5b14e6866141b6396c476f3ea636f93

SHA256
d3a200d9b955473c9f107e069bf69ccf0a26b0587dd55323c331c0aa6a879c91

SHA512
557df0fccd6e27d8231c5e390eb3ba79c4acbfb120ba22bceef63e3eae0413c41f6ff3f1f7d970e561ec40714bad8225a4712670b2b3def1078bf7ca1ed7bdad

Download Submit
/tmp/vga.conf

Filesize
4B

MD5
1e0a84051e6a4a7381473328f43c4884

SHA1
070ee49d20d19d115980014895f74c406c05bf05

SHA256
3045ad039274b9fcf0ec609cc45c0d8e3558c06315802f46946d8d0e014b4520

SHA512
60674d6204f97956e6dd536d5d99306f4ce1ecaf7e2ff744a87a555fbefbf1d32e7d907ae796c78485cd4fcabfd93b375f54fe6041daf1a3d2bb5a1b821b459d

Download Submit