Analysis
-
max time kernel
148s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
-
submitted
27-09-2024 10:27
General
-
Target
fa3c5093d7a41141fdb361c3f481154f_JaffaCakes118
-
Size
45KB
-
MD5
fa3c5093d7a41141fdb361c3f481154f
-
SHA1
39783f5fe31146fafb4bbbb29ef7bb53c1b84544
-
SHA256
a55dfa25651c1aefe160be6d7f1f4fb05521825e1779f5a22ff374f15ceefb74
-
SHA512
f8457ceae5ece036d4999dc80ce65e6312ba2d4fb4618733e33df3f1331421b42dce2879910e9da9046fd9edfda9690ef7135ffea098fa297efe55a80e0c3e15
-
SSDEEP
768:/thg3pqmFG5cw/6BaWgfcxJjF8itAdkDxF2lKBKw9PMNPtkG9VhSVSCp:/Dg3YaG5JyNkOOQA+dF2yKw9PMNP6IVP
Score
9/10
Malware Config
Signatures
-
Contacts a large (117344) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Loads a kernel module 55 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Modifies Watchdog functionality 1 TTPs 1 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes
-
/tmp/fa3c5093d7a41141fdb361c3f481154f_JaffaCakes118/tmp/fa3c5093d7a41141fdb361c3f481154f_JaffaCakes1181⤵
- Loads a kernel module
- Modifies Watchdog functionality