be1aab3c7f7b1a31a4480e382a833cfbed3edaa39891d77dc7d30f786dbb8d22

Analysis

max time kernel
120s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26-11-2024 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118
Size

127KB
MD5

9ffd16e64f31b0c96e2953f7f5fd443b
SHA1

57604676b2c6f76a19ab0f8d0ceaa1780aa775c3
SHA256

be1aab3c7f7b1a31a4480e382a833cfbed3edaa39891d77dc7d30f786dbb8d22
SHA512

912cc4109081278a63bbe9c46b0cda279edad5905332c5ab5f48fba22f25374fba726d8c77b979c6b91ac06d9038f886340ecbef3f2cc1ecbe08ae3c17b11a0c
SSDEEP

3072:XHz0QOD5sNkVF4KzVuaeb36omJuADOfdnsi3lmygQ0xhp1RB:BKzsaQCuADO1mygQ0xX1RB

Score

6^/10

discovery

Malware Config

Signatures

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

Processes:

9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118

description	ioc	Process
File opened for reading	/proc/net/route	9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118

Changes its process name 1 IoCs

Processes:

9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	653	9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

Processes:

9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118

description	ioc	Process
File opened for reading	/proc/net/route	9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118

/tmp/9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118
/tmp/9ffd16e64f31b0c96e2953f7f5fd443b_JaffaCakes118
1⤵
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:653

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads