Analysis
- max time kernel
150s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
10/09/2026, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
10 signatures
150 seconds
General
- Target jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin
- Size 131KB
- Sample260910-rn1g3ahc67
- SHA256 95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632
- MD5 a1f98636dbae01e7188cfe0798e3c48d
- SHA1 3a1f4377e9857dc41897430e38e25a0b3ee6cec6
- SHA512 f7b194d788be7bcda62e2c07a03e1b72fe7e09806a7923068b0936473e9474ca84ebd2739c4b4e4ac4de9a6d06daf5ffef7ade99d1ab9f731713a587816e8824
- SSDEEP 1536:nhVb3PrIT9wto8uWcfb1nc7nfvXPrQA96xOXJDPjf5NQfVIOEDH+t8t8nRbVR15H:nh9438uVfb9c7nXRXJ/REqH+I8nR95H
- TLSH T146D3E9086F718E7BD4AFCC3742A84B4A18CDA11B31693BB539B4E504FE5A14F46E38B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (11575) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 802 jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 6 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/828/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/838/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/841/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/825/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/826/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/827/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 802 jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin -
description ioc Process File opened for reading /proc/389/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/431/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/705/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/762/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/827/cmdline jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/326/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/663/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/678/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/796/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/352/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/379/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/806/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/828/cmdline jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/377/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/180/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/405/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/767/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/self/maps jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/380/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/201/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/677/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/710/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/826/cmdline jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/838/cmdline jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/841/cmdline jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/394/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/406/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/765/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/797/status jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin File opened for reading /proc/825/cmdline jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin
Processes
-
/tmp/jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin/tmp/jaffacakes118_95c62b7d34345a4ff325720538b764c2adf1bc07f2efec44951cc2c8f6a91632.bin1⤵
- Renames itself
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:802