df3690f201648974bee6d28ef657ca25fd09b9fc8f1e5430c761976a885a2e6e

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
25-09-2024 09:50

Target

f5bdb38d2757ba068b5d1a75c299815f_JaffaCakes118
Size

172KB
MD5

f5bdb38d2757ba068b5d1a75c299815f
SHA1

4ee11dc7fea4c32b88a4b76f6b59883c847bdbd0
SHA256

df3690f201648974bee6d28ef657ca25fd09b9fc8f1e5430c761976a885a2e6e
SHA512

4bdc7107fe1e116a5b018d86e5c80ed56f117130a57cd0cfb684fd0f8902d3db6df8e80dcaeaa4575a5435189555cf9bc9740e9b7b998ca8b6feaf920b62bb94
SSDEEP

3072:haEs6u+aYb/JHTQ4GwHuRLJmOpNlIthWmGBR9A+lfQAD+l+i:habJHChH84LuR9mOpNshWmGBR9A+lfQp

Score

7^/10

rootkit

Loads a kernel module 2 IoCs

Loads a Linux kernel module, potentially to achieve persistence

Processes:

f5bdb38d2757ba068b5d1a75c299815f_JaffaCakes118

pid	Process
2474	f5bdb38d2757ba068b5d1a75c299815f_JaffaCakes118
2474	f5bdb38d2757ba068b5d1a75c299815f_JaffaCakes118

/tmp/f5bdb38d2757ba068b5d1a75c299815f_JaffaCakes118
/tmp/f5bdb38d2757ba068b5d1a75c299815f_JaffaCakes118
1⤵
- Loads a kernel module
PID:2474