Analysis
-
max time kernel
148s -
max time network
152s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
06-01-2025 07:57
Behavioral task
behavioral1
Sample
JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
2 signatures
150 seconds
General
-
Target
JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a
-
Size
45KB
-
MD5
17ab8131fc2ddacbeac40966491aee1a
-
SHA1
1a44858855f3b3157e48d05889f15a6983f512cf
-
SHA256
920267c907ce2e9dbc342eab71e188224733321a3cd33b72ef60fa0d71515790
-
SHA512
2a32d44d827bf0f83301a7d2bc852033dd5481ed85f5f0dd23d115ce566b4e7161d490689f6255c62bff651e4c3709e6cce57941c0ddffa82e3c1d06ca5a7376
-
SSDEEP
768:53sPWVrWy7PBIedilokjFMdMh80otXzAlxKUu141AaIK5pYim6gls:/D9I8ilokjFMdMu0iALKH14SDKLrm6As
Score
7/10
Malware Config
Signatures
-
Loads a kernel module 56 IoCs
Loads a Linux kernel module, potentially to achieve persistence
pid Process 2826 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a 2827 JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/a833wqon4q3vtrd2wdqb3e8aldrt JaffaCakes118_17ab8131fc2ddacbeac40966491aee1a