Analysis
- max time kernel
149s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
10/09/2026, 08:18
Behavioral task
behavioral1
Sample
jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin
Resource
debian9-mipsbe-20260513-en
debian-9-mips
8 signatures
150 seconds
General
- Target jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin
- Size 97KB
- Sample260910-j6958agb79
- SHA256 b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4
- MD5 59a9740f54bd4769a1f68ecffca5a7c6
- SHA1 d6920fbfbfacf9549d3bba11fd266b8081f8b24f
- SHA512 d61b6463041e46e32ae0e50583b935e13ee42c887d62c5172ea8816afed9b4033910d96ec6fafb25b33f0d8fecd4d98272fd095f2cc1b55c94565ccab5c18127
- SSDEEP 3072:SPuuLIRcArpHclLV9jjr8od8jA30pGlp8:SPuuLFArBcl59/r8u0paa
- TLSH T1C8A3B65E6A674FBDF7AC863647B7DE20C248339223D1E145E0ACE9019E7034A785F7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 710 jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for modification /dev/misc/watchdog jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ec7pvq2p8h5phm5gccl2lds8 710 jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin Changes the process name, possibly in an attempt to hide itself ac5phd5pbd5pr82g 713 jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin -
description ioc Process File opened for reading /proc/1268/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1304/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2210/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1419/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1651/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1904/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2214/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/352/fd jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/708/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1116/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1517/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1809/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2030/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2087/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1484/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/816/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1053/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1160/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1337/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1570/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1695/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1744/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/711/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1131/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1225/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1912/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1913/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1971/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2061/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2135/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1/fd jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/748/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/894/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/909/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/936/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/953/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1292/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1334/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/319/fd jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1033/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1221/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1237/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1287/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1803/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1929/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2085/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/932/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/966/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1192/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1271/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1858/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1944/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2039/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2148/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/227/fd jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/410/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/937/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/938/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1110/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1259/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/1712/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/2190/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/843/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin File opened for reading /proc/853/exe jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin
Processes
-
/tmp/jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin/tmp/jaffacakes118_b4b0ddbf8b558901d618bc9a54b280af4990b3498a5332f8fe16dad35720a8c4.bin1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:710