Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
-
submitted
24-11-2024 02:32
General
-
Target
920f246bf645b8b84ec280fcbfdb0567_JaffaCakes118
-
Size
140KB
-
MD5
920f246bf645b8b84ec280fcbfdb0567
-
SHA1
e0965931e2bd1f5ce17a6743e17c3365fd7f6902
-
SHA256
85ca42b4d916cfdb5d69a2ff13f679dfdc76749ab1cdd47d7a0962bc5e87735b
-
SHA512
04ca19e0ea12f0dddde083a1f7f21a8a2dcff67780b2daa6e25ec6f4028783dcc6c77285fd471ffca8c75ff3386d169e78bcc69f8dafcc993362b367d93d8be2
-
SSDEEP
3072:ezwFzskMXc8TfskyCBkIOVPem4MSRpWo+DA6Dcoixgr1TkM3Q:eGMXxJyCbOId9EDcoixgr1TkM3Q
Malware Config
Signatures
-
Contacts a large (71518) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Changes its process name 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes
-
/tmp/920f246bf645b8b84ec280fcbfdb0567_JaffaCakes118/tmp/920f246bf645b8b84ec280fcbfdb0567_JaffaCakes1181⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration