Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
10/09/2026, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin
Resource
debian12-armhf-20260127-en
debian-12-armhf
7 signatures
150 seconds
General
- Target jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin
- Size 81KB
- Sample260910-kxhv2stwft
- SHA256 ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa
- MD5 412299e873162b361753e8948409e7ee
- SHA1 220eed03bbc5887009d357c8725d63331e823244
- SHA512 6df759d1dc1919e0fa94e82e07a0188a8c5541d2550bbf0961be38e795a26df486d287dd2820408cf615fe3b5d25dd8a169deae078786fd00aba7b6885f0800e
- SSDEEP 1536:3Zn+LFqkVjtSWqDGhN3F0uA+pbgPj/XO7LZqSllsxigCie7RLmZdYmuXTAbVR:wLUkTSWqDGXVgPbXO7LwnCh7RCP6XTA
- TLSH T1EC83078AF9819F51D5D566BAFF0F518C331347A8E3FA72039D246B25678B82B0F7A401
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (2669) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 781 jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin - Unexpected DNS network traffic destination 45 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 781 jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin -
description ioc Process File opened for reading /proc/676/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/728/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/782/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/642/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/193/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/321/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/338/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/367/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/381/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/731/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/734/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/218/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/313/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/362/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/624/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/788/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/254/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/345/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/348/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/683/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/319/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin File opened for reading /proc/643/status jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin
Processes
-
/tmp/jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin/tmp/jaffacakes118_ba4113b93d4b7e41cc91f3050572bb19cdb7618b8bcf7ebc095aaaf5dd4cf2aa.bin1⤵
- Renames itself
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:781