Analysis
- max time kernel
149s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20251223-en - resource tags
arch:mipsimage:debian9-mipsbe-20251223-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
28/12/2025, 17:09
Behavioral task
behavioral1
Sample
JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324
Resource
debian9-mipsbe-20251223-en
debian-9-mips
9 signatures
150 seconds
General
- Target JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324
- Size 30KB
- Sample251228-vpkpsahn3x
- SHA256 f7f9d96405d2ed78796ce7b2b6d0e55d148d31d8574c151f37c4048942e0da5b
- MD5 3e5395bd88bfc3f54bfb5d3f3156b324
- SHA1 63d5aca051f3fb94efea0958141d38f8d1704313
- SHA512 257d473373ecb1a7dfe01cdc05d2f8cb7dab509e5e8e2c891436f03dc1c1c84a7a395ab7eda7f6ef0ce9a25fe330920a19d88df4e367e740a1f3f38e2a4ca980
- SSDEEP 768:Y063lWn7Pth4jplhL/b2hrqWdZX7DLcJgGlzDpbuR1JU:YXMn7lh4jfhL/0//X4VJue
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
UNST
Signatures
- Mirai family
- Contacts a large (20443) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for modification /dev/misc/watchdog JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 -
description ioc Process File opened for reading /proc/672/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/675/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/1/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/148/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/700/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/730/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/714/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/699/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/704/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/170/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/331/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/426/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/665/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/669/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/745/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/248/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/338/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/340/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/378/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/717/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/780/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/426/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/674/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/706/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/716/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/672/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/784/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/339/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/669/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/674/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/699/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/714/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/792/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/377/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/675/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/710/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/712/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/713/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/717/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/665/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/707/exe JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/333/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324 File opened for reading /proc/381/fd JaffaCakes118_3e5395bd88bfc3f54bfb5d3f3156b324