Analysis
-
max time kernel
152s -
max time network
163s -
platform
debian-12_mipsel -
resource
debian12-mipsel-20240221-en -
resource tags
arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem -
submitted
09-12-2024 22:32
Static task
static1
Behavioral task
behavioral1
Sample
dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118
Resource
debian12-mipsel-20240221-en
General
-
Target
dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118
-
Size
40KB
-
MD5
dbd9855f4f836b8cf6912e58591c0a1f
-
SHA1
17c3f4ac0cb897833828847618b47b9dc9ee394c
-
SHA256
7574957d7875b1ff3fa42df03bcf2c8d0d6ef1a8788626e96583e5f75860123a
-
SHA512
9f377b0bbec758bd9918c1e1188a3927fd78193129943f3825eecc553d294b797f2f3c0d5ddb8b3a1e45d765ba18b17e4a47bc83f444e734ad4ce6a98f729f81
-
SSDEEP
768:XNj6FUjiQQp4jhH4xcPPqBYSoDwKiWi+dwbwuw9ptVL48VqWRB:wA0p+qB2DBi8dowuKptlfVj
Malware Config
Extracted
mirai
KYTON
Signatures
-
Mirai family
-
Contacts a large (62295) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for modification /dev/misc/watchdog dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /bin/watchdog dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself Z77PfJusVJ6V 736 dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 -
description ioc Process File opened for reading /proc/711/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/718/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/821/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/827/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/851/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/879/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/904/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/401/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/932/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/698/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/747/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/911/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/922/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/942/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1002/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/618/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/695/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/804/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/848/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/876/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/887/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/925/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1007/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/410/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1044/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/896/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1022/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1023/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1029/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1039/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/805/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/773/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/850/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/901/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/903/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/984/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1001/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/713/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/828/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/964/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/740/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/847/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/881/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/921/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/923/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/945/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/969/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1050/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/self/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/716/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/788/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/830/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/902/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/946/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/968/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/406/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1025/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/729/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/983/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1017/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1040/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/1045/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/982/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118 File opened for reading /proc/789/exe dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118
Processes
-
/tmp/dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes118/tmp/dbd9855f4f836b8cf6912e58591c0a1f_JaffaCakes1181⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Writes file to system bin folder
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:736