f880e1f9b1db9847990670a0207f69a95cae7f257b684cfcd7a919b2feb38032

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
26-09-2024 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7eb81fc660ece0137653be2632629e8_JaffaCakes118
Size

1.5MB
MD5

f7eb81fc660ece0137653be2632629e8
SHA1

6b56ee419cab7d24e9550c33f227898562d2bb6e
SHA256

f880e1f9b1db9847990670a0207f69a95cae7f257b684cfcd7a919b2feb38032
SHA512

0bcb85342f189f6e1c4d4ecacb44c59629f95993bb3645d490f3a9ceb65a922bea051598a790543735a7470080f9f43a0b8ac72a434775a067183761e14cade8
SSDEEP

49152:27ilOolLbt1laIunbZsehkvS55555555555555555555555555555555555k55w1:CeOolLbt1laIunlsehvNtYi7COEm

Score

7^/10

defense_evasion discovery persistence rootkit

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
2569	chmod
2579	chmod
2589	chmod
2600	chmod
2608	chmod
2616	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	2537	getty
/usr/bin/.sshd	2556	.sshd

Loads a kernel module 64 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

pid	Process
2496	f7eb81fc660ece0137653be2632629e8_JaffaCakes118
2498	Process not Found
2502	Process not Found
2498	Process not Found
2498	Process not Found
2504	Process not Found
2498	Process not Found
2498	Process not Found
2506	Process not Found
2498	Process not Found
2498	Process not Found
2508	Process not Found
2498	Process not Found
2498	Process not Found
2510	Process not Found
2498	Process not Found
2498	Process not Found
2529	Process not Found
2498	Process not Found
2498	Process not Found
2531	Process not Found
2498	Process not Found
2498	Process not Found
2533	Process not Found
2498	Process not Found
2535	Process not Found
2536	Process not Found
2537	getty
2535	Process not Found
2498	Process not Found
2539	Process not Found
2498	Process not Found
2498	Process not Found
2541	Process not Found
2498	Process not Found
2498	Process not Found
2543	Process not Found
2498	Process not Found
2538	Process not Found
2545	Process not Found
2538	Process not Found
2538	Process not Found
2547	Process not Found
2538	Process not Found
2538	Process not Found
2549	Process not Found
2538	Process not Found
2538	Process not Found
2551	Process not Found
2553	Process not Found
2554	Process not Found
2538	Process not Found
2538	Process not Found
2555	Process not Found
2556	.sshd
2538	Process not Found
2538	Process not Found
2558	Process not Found
2538	Process not Found
2538	Process not Found
2560	Process not Found
2538	Process not Found
2538	Process not Found
2562	Process not Found

Write file to user bin folder 8 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/ss	cp
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp

Writes file to system bin folder 3 IoCs

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/compression	insmod
File opened for reading	/sys/module/compression	insmod

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod

/tmp/f7eb81fc660ece0137653be2632629e8_JaffaCakes118
/tmp/f7eb81fc660ece0137653be2632629e8_JaffaCakes118
1⤵
- Loads a kernel module
PID:2496
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:2503
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:2505
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:2507
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:2509
- /usr/bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:2511
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2530
- /usr/bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:2532
- /usr/bin/cp
  cp -f /tmp/f7eb81fc660ece0137653be2632629e8_JaffaCakes118 /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2534
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2537
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
    3⤵
    PID:2546
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
    3⤵
    PID:2548
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
    3⤵
    PID:2550
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
    3⤵
    PID:2552
- - /usr/bin/ln
    ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
    3⤵
    PID:2557
- - /usr/bin/mkdir
    mkdir -p /usr/bin/dpkgd
    3⤵
    - Reads runtime system information
    PID:2559
- - /usr/bin/cp
    cp -f /bin/lsof /usr/bin/dpkgd/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2561
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2563
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2565
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/lsof
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2567
- - /usr/bin/chmod
    chmod 0755 /bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2569
- - /usr/bin/cp
    cp -f /bin/ps /usr/bin/dpkgd/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2571
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2573
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2575
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ps
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2577
- - /usr/bin/chmod
    chmod 0755 /bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2579
- - /usr/bin/cp
    cp -f /bin/ss /usr/bin/dpkgd/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2581
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2583
- - /usr/bin/mkdir
    mkdir -p /bin
    3⤵
    - Reads runtime system information
    PID:2585
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /bin/ss
    3⤵
    - Writes file to system bin folder
    - Reads runtime system information
    PID:2587
- - /usr/bin/chmod
    chmod 0755 /bin/ss
    3⤵
    - File and Directory Permissions Modification
    PID:2589
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2591
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2596
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2598
- - /usr/bin/chmod
    chmod 0755 /usr/bin/lsof
    3⤵
    - File and Directory Permissions Modification
    PID:2600
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2602
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2604
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ps
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2606
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ps
    3⤵
    - File and Directory Permissions Modification
    PID:2608
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2610
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:2612
- - /usr/bin/cp
    cp -f /usr/bin/bsd-port/getty /usr/bin/ss
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:2614
- - /usr/bin/chmod
    chmod 0755 /usr/bin/ss
    3⤵
    - File and Directory Permissions Modification
    PID:2616
- - /usr/sbin/insmod
    insmod /usr/bin/bsd-port/xpacket.ko
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2630
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2540
- /usr/bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:2542
- /usr/bin/cp
  cp -f /tmp/f7eb81fc660ece0137653be2632629e8_JaffaCakes118 /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:2544
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  - Loads a kernel module
  PID:2556
- /usr/sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2618

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
1c702e5ee696a1ac118768f61daa9779

SHA1
6751a7cf2902df8819a1b3e8d6b5ed77a865f157

SHA256
a37f359aca6e1917e46080e1cbff42fb43d3de083e6b2550e6993ebab55b805d

SHA512
f333375d4453f9f2599c4938dc05839c54f14b9540f476ef071261038f8c4883e77d649d5e2a6ba3c4fef996028f72812e57406332955696ae963c1d49d516f1

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/conf.n

Filesize
73B

MD5
6c16a265e898152cab0d8f691982fe38

SHA1
89bd13bf7006c3ad2662217463bca57df549d844

SHA256
b93b44a01b890bc475a5bd3e14e6044cb5e3b339cd5b4267a124e326a494f0f1

SHA512
966a1ab59b16a3b98c68d8c6777d977f454dab853eff2272781379be2aa0cdc09c28c7556eaeda59730630a173dd72cfb9789197069060219e1ef7c3ebae865d

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
9af76329c78e28c977ab1bcd1c3fe9b8

SHA1
b99dfad9dfce6db8291c587455dec8f5ab378920

SHA256
0b8c4c7c81ac3255024f978a24c4c63bb034cc40ed2fe51dec83cb28c8785a87

SHA512
668d2295ecadcda8fcc02a365e4581723081509faa870d4f5d8fdb6af85519d477b0c8529212449f9f4d2d880c57d205b85753f42f6e5e25295b9ec473a9a953

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
18bb68e2b38e4a8ce7cf4f6b2625768c

SHA1
1749e00b294522e5a35f798a614395d417b46ba6

SHA256
f6142d191a2f19d20f07ba7ede424003d67a0f5987a99d150e65d93eaa44b1de

SHA512
a139dc3217fbfd12d0c22e69b4154f6a7dc9dd0a3be286487c1d209858b0b87cdd60165b6f2a39c330b57eeac6360a4d65859f597784ce0c077bf40bbbd18f8d

Download Submit
/tmp/notify.file

Filesize
51B

MD5
738b9c1139253332f272f24a7f4ecb77

SHA1
9ffcb152dbeca701f1a00419a686bd1c7a1b2543

SHA256
7e9c3457d5aa9c3c7173797c6572a2b8927c28c773967a6fd3a196984540a5fc

SHA512
d3d91a5dd7cfeda5172cd75276544acab083f0732251cb28072482523a6a25c833280891bcc4a763cb2a522d5e697b67eebf5126342303bd6fdb7f2a27b9d737

Download Submit