Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
10/09/2026, 08:18
Behavioral task
behavioral1
Sample
jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
8 signatures
150 seconds
General
- Target jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin
- Size 65KB
- Sample260910-j69vfszhjd
- SHA256 2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86
- MD5 63b3bab1b3189dcc45441a3740b5c2cf
- SHA1 221bf7fff97d8de26e113b4629318d58923ce84c
- SHA512 eed2c6ac1e027ed34b3604bced34b768be115449aa4c18f52dae2120f8ec2887d874c9dc4076f285fe96a26810af46cda7724a6591304c4672130666b07a605a
- SSDEEP 1536:6a36ng9AZwynlBSq9ge0Iw6bSnK/ITlYMEh:sg9AZ7nlBSq2e0Iw6bIKAx
- TLSH T144632BC56602DAF0FC294171E0AAFF3E4677E53E0119D99FD7958AB1E4A3B029B0139C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1471 jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for modification /dev/misc/watchdog jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1471 jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin Changes the process name, possibly in an attempt to hide itself 1473 jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin -
description ioc Process File opened for reading /proc/2088/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1043/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1868/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/335/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/448/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/511/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/437/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/552/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/670/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1038/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1148/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/651/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/722/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1238/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1245/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1308/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1330/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1524/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2045/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/268/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/635/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/674/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/678/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1054/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2069/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2083/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/448/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/457/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/890/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/897/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/933/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1479/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1525/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1751/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/433/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/440/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1005/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1165/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2046/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2053/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2064/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/956/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1060/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1078/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1469/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/534/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/438/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1016/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1438/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2070/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/426/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/466/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/434/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/636/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1057/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1642/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2047/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/534/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/900/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1127/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1645/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/2090/exe jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/1/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin File opened for reading /proc/464/fd jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin
Processes
-
/tmp/jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin/tmp/jaffacakes118_2cbec64ed22c8ac2bf57cd7dc8642b96a274358bd79b61fb6c2102db5070ff86.bin1⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1471