Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
10/09/2026, 08:17
Behavioral task
behavioral1
Sample
jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
8 signatures
150 seconds
General
- Target jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin
- Size 65KB
- Sample260910-j62h3shr5t
- SHA256 5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347
- MD5 dcb5580d687287487d1f4847b0bdb4cc
- SHA1 ca4ebb6b73c8eb7a13bf2784fa35407163c5bc7f
- SHA512 00e5d135153e31e4c6cfbd4c420ba5edc8e52fc249ab8dcfa0135604386d021154e738813b12863ebcde07a527d984e72a9808ddd83ee11bd685ce634d3a49d9
- SSDEEP 1536:6a36ng9AlwynlBSq9ge0Iw6bSnK/ITlfMEh:sg9Al7nlBSq2e0Iw6bIKAx
- TLSH T1C4632BC56602DAF0FC294171E0AAFF3E4677E53E0119D99FD7958AB1E4A3B029B0139C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1509 jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for modification /dev/misc/watchdog jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1509 jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin Changes the process name, possibly in an attempt to hide itself 1511 jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin -
description ioc Process File opened for reading /proc/690/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/966/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1567/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/540/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1085/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1094/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1523/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2107/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1895/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2086/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2091/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/501/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1066/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1082/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1970/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/253/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/487/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1048/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1105/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1566/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2127/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/517/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1512/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1101/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1501/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/423/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/462/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/462/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/524/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1017/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2112/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/984/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2111/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/self/status jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/694/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1040/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1114/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2103/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/917/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1179/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1639/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2090/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/487/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/555/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1522/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/457/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/513/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/674/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1109/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1180/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1274/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1517/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/2116/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/571/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1061/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1562/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/325/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/524/fd jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/672/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/946/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1161/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1343/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin File opened for reading /proc/1638/exe jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin
Processes
-
/tmp/jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin/tmp/jaffacakes118_5076c4d23ffe212aaec8aadb6550f5069d1c359d30a6019f931f8001acd63347.bin1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1509