Analysis
- max time kernel
151s - max time network
160s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
10/09/2026, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
9 signatures
150 seconds
General
- Target jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin
- Size 76KB
- Sample260910-kxd7vs1bkf
- SHA256 0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb
- MD5 ea55d9bacbfcbc97b336424e5ada3be7
- SHA1 9bdd5b2ed7cabbb40cdc916f30e698f296d3f186
- SHA512 a9761f26266bf7ce8ffc0eb1d3f581e3071f9f77c695561f1f592abd3593efa7c8512601df384761c0e46ec05e786d11c2bd7da2c5942b0d4e6a972857f7964f
- SSDEEP 1536:3GoAhSESnEnZmGFppbAdzxGUfoAsZJWmlY1UXYKgTAbVR:3GLDnZKGLdYRTA
- TLSH T1D873D749BBA04FBBD86FDD3741BD4B4525DC824322A83B797974D818F24A14F4AD38B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (2708) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 798 jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin - Unexpected DNS network traffic destination 45 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 19 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/836/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/840/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/841/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/811/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/839/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/808/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/838/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/829/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/833/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/809/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/810/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/820/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/823/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/825/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/826/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/814/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/816/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/828/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/827/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 798 jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin -
description ioc Process File opened for reading /proc/180/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/810/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/811/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/825/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/391/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/394/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/663/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/762/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/799/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/446/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/709/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/768/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/796/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/814/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/841/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/379/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/380/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/808/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/823/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/201/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/404/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/405/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/765/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/809/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/827/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/838/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/312/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/816/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/820/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/833/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/836/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/332/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/377/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/678/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/714/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/self/maps jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/826/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/828/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/829/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/677/status jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/839/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin File opened for reading /proc/840/cmdline jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin
Processes
-
/tmp/jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin/tmp/jaffacakes118_0b468f57fbd02692cdfaa4e1e97fd661a882fbba8b0c783487ad2ee1d3a935eb.bin1⤵
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:798