Analysis
-
max time kernel
37s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
18-12-2024 11:52
Behavioral task
behavioral1
Sample
fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118
Resource
debian9-mipsbe-20240418-en
General
-
Target
fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118
-
Size
30KB
-
MD5
fb6dc629f3cea2f4968bf1dfb286276a
-
SHA1
6c8f03d87844af15df78fe1490683ee854dc320e
-
SHA256
f1edcebbddd718478622d047705e872ad26fa577f40f57c2dbfd902ea4bafeab
-
SHA512
59084359debf89dc0e00c5bcf143f7567854992a9f997e42874c4269ecea004d08fce7db1a74907a470107b4c61f3607edc7440fe51a1a04edecdd759e6c9fa0
-
SSDEEP
768:4VyvYLznDEB2iC+sDqC6NtxsPCekdob4dc1WokdX9JgGlzDpbuR1JY:4AYnnDEBI+smICekdoT1LOVJuq
Malware Config
Extracted
mirai
UNST
Signatures
-
Mirai family
-
Contacts a large (20504) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for modification /dev/misc/watchdog fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 -
description ioc Process File opened for reading /proc/733/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/704/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/148/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/730/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/354/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/663/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/732/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/666/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/794/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/798/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/1/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/328/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/820/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/734/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/724/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/744/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/383/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/727/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/422/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/666/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/704/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/721/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/670/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/723/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/169/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/359/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/733/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/725/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/373/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/718/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/727/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/329/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/729/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/719/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/422/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/356/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/374/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/670/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/663/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/669/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/718/exe fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/244/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118 File opened for reading /proc/669/fd fb6dc629f3cea2f4968bf1dfb286276a_JaffaCakes118