Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240226-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    13/10/2024, 11:23

General

  • Target

    3f8feac362d48cd5bedecd68dbf7d842_JaffaCakes118

  • Size

    39KB

  • MD5

    3f8feac362d48cd5bedecd68dbf7d842

  • SHA1

    bbdf1e1d549dd8cd86b34d2a12e640c462acd223

  • SHA256

    d3ca6ad01e7d857dcce7f65ba95a8d8fb7ce49006d4c17d93579f09b953b9f51

  • SHA512

    c1965af2d40b645c68b72a20077175682661abc32701353ddc7b3b0d1bf98ecf0050f3e2dca48852642b1a3452e9784149399ef43b4ee70743cb212d1afbae47

  • SSDEEP

    768:tlP8BJDGDo6vUf2XnAza6WAI5/JTKud2duDYpJ7pYaDdWRt:XiJwdvUeXn+a9jJTKtdmY9VM

Malware Config

Extracted

Family

mirai

Botnet

KYTON

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Contacts a large (83428) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 1 IoCs
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/3f8feac362d48cd5bedecd68dbf7d842_JaffaCakes118
    /tmp/3f8feac362d48cd5bedecd68dbf7d842_JaffaCakes118
    1⤵
    • Modifies Watchdog functionality
    • Enumerates active TCP sockets
    • Writes file to system bin folder
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:690

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads