Analysis
- max time kernel
148s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
10/09/2026, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin
Resource
debian9-mipsbe-20260513-en
debian-9-mips
6 signatures
150 seconds
General
- Target jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin
- Size 91KB
- Sample260910-n5kldsserf
- SHA256 ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9
- MD5 c3aecf7b44b32a23b96cf6dbc1f35640
- SHA1 8b16bb310ce9e619a74f864b5dd343fdbde03513
- SHA512 1586b0e8c805d35c23a483947027991455403841a0ddd9eae3e510c220c98d4dbc724012dc1621681bdea634404df3cb3a1136841d1b9cce8626605222a893a1
- SSDEEP 1536:OmAdF/HaC+db+XEZ5Q03c0KPmyRWLisvR7VeOKGf3S6pm56x:GdxHaC+dbQ0KPp0L7vRtSam5o
- TLSH T1C793B70E6E219FADF359873047B78A21A79D33C636E1D685E25CD6002F6074E641FFA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 724 jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for modification /dev/misc/watchdog jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/125/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/152/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/907/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/19/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/111/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/389/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/843/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/865/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/70/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/72/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/9/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/77/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/396/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/683/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/826/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/950/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/5/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/7/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/21/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/880/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/946/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/993/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/126/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/688/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/929/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/36/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/686/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/721/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/11/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/17/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/24/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/348/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/971/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/990/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/76/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/374/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/864/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/895/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/945/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/967/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/978/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/14/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/83/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/720/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/2/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/22/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/73/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/74/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/84/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/175/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/911/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/918/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/8/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/12/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/15/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/75/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/689/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/958/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/20/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/37/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/78/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/712/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/4/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/18/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself rfap638ifn8if8or16p2kfvogvu6 724 jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin -
description ioc Process File opened for reading /proc/76/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/388/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1015/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/11cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/19/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1023/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1083/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/20/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/75/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/76cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/160cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/4/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1060/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/16/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/24/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/348/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/967/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1060/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/262cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/929/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/721cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/787cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/84/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/720/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/911/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/77cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/346cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/712cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/918/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/24cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/791cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/111/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/3cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/671cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/13/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/374/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/686/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/958/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1037/maps jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1045/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/348cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/719cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/37/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/895/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/9cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/344cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/686cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/792cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/125/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/843/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1033/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/71cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/714cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/81/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/865/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/886/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/990/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/1001/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/84cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/726cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/803cmdline jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/7/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin File opened for reading /proc/175/stat jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin
Processes
-
/tmp/jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin/tmp/jaffacakes118_ac4c2950effb6e4ea8393da4313e406f1d934e31c19c589cf4065fc70d56b0c9.bin1⤵
- Deletes itself
- Modifies Watchdog functionality
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:724