Analysis
- max time kernel
148s - max time network
148s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
10/09/2026, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin
Resource
debian12-armhf-20260127-en
debian-12-armhf
5 signatures
150 seconds
General
- Target jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin
- Size 153KB
- Sample260910-n5k7xssfja
- SHA256 f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e
- MD5 485bf35ef6c731e2265a358bca78e76c
- SHA1 7b45ad51d43a7dd0d44f3208998b70e5ee073968
- SHA512 caf8b8ba628f76fb8ce136288baa064c33376978477c652bb22400a5d4e08589e5be5a6cad31b7f2573f4eb9838ec047f061bb1b2035a6afab7fe64560a04d45
- SSDEEP 3072:XaI7UlXolsaASeYu6W75Hd2D/6LGhFHyMhLM/9YwA2v:XaI4osaASeYu6c5EDCLAtyMdM/9k2v
- TLSH T1C7E34B46E6418B13C0D5277ABAEF42453323AB64D3DB73069924BFB43F8679E0E63605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 778 jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for modification /dev/watchdog jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin - Reads process memory 1 TTPs 15 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/11/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/33/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/77/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/444/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/55/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/88/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/777/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/22/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/44/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/333/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/66/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/99/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/111/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/555/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself rloga62i4488 778 jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin -
description ioc Process File opened for reading /proc/7777�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/6666�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777v;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777x;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/111h/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222|/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222v�/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222c�/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/444cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/88/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/1111�/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333e5cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/33/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/444/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/444d�/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/1111g2cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333�4cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333j5cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/6666T8cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/33cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222r/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/2222|;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/6666M7cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/555/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/6666/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/555cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/6666/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/777/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/22cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/55cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/111^/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333�4cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/2222/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/99/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/2222L4cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333fffffffcmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/6666�:cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777 ;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/66/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/222/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/111uf/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/111cn/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/88cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/99ss\/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/111cp/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/333s�/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/2222�3cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/3333p4cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/333cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/777k�/cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/7777�;cmdline jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/1111/maps jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/11/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin File opened for reading /proc/22/stat jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin
Processes
-
/tmp/jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin/tmp/jaffacakes118_f4a7120e0edf70c07281191f88e4af41eeb9e3392dde0da9c9d30718865fed7e.bin1⤵
- Deletes itself
- Modifies Watchdog functionality
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:778