Overview

overview

10

Static

static

10

jaffacakes...2f.bin

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    10/09/2026, 09:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f.bin
  • Size 152KB
  • Sample260910-ky4txa1bnf
  • SHA256 0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdiscoverymiraipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • mirai

C2

  • 86.54.42.154

Signatures

  • Family: Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

    botnetmirai
  • Contacts a large (108291) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes itself 1 IoCs
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 1 IoCs
    persistence
  • Changes its process name 3 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/jaffacakes118_0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f.bin
    /tmp/jaffacakes118_0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f.bin
    1⤵
    • Deletes itself
    • Enumerates active TCP sockets
    • Modifies systemd
    • Write file to user bin folder
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:1472
    • /bin/sh
      sh -c "systemctl daemon-reload 2>/dev/null"
      2⤵
        PID:1475
        • /bin/systemctl
          systemctl daemon-reload
          3⤵
          • Reads runtime system information
          PID:1476
      • /bin/sh
        sh -c "systemctl enable sysd 2>/dev/null"
        2⤵
          PID:1504
          • /bin/systemctl
            systemctl enable sysd
            3⤵
            • Reads runtime system information
            PID:1505
        • /bin/sh
          sh -c "systemctl start sysd 2>/dev/null"
          2⤵
            PID:1526
            • /bin/systemctl
              systemctl start sysd
              3⤵
              • Reads runtime system information
              PID:1527

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              sysd.service
              • Path /etc/systemd/system/sysd.service
              • Size 168B
              • SHA256 6b6eed2c7dc667440f150eb7b5d93dcfb17c63df4125168ecd04ddd93e3a9581
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              .sh
              • Path /usr/bin/.sh
              • Size 152KB
              • SHA256 0f17b91bf13550086de8c2db040ad47b46dba4d058a4da2d608191a3f5ab052f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download