Overview

overview

10

Static

static

5

jaffacakes...478b64

debian-12-armhf

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    17/09/2026, 12:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_e92eaa9965b8a86c30a747608d7fc03162669968b4b9502f702556f34f478b64
  • Size 1.1MB
  • Sample260917-pvsdxsdf39
  • SHA256 e92eaa9965b8a86c30a747608d7fc03162669968b4b9502f702556f34f478b64
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdiscoveryexecutionxmrigminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 20 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 15 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/jaffacakes118_e92eaa9965b8a86c30a747608d7fc03162669968b4b9502f702556f34f478b64
    /tmp/jaffacakes118_e92eaa9965b8a86c30a747608d7fc03162669968b4b9502f702556f34f478b64
    1⤵
    • Changes its process name
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:785
    • /bin/sh
      sh -c "command -v crontab >/dev/null 2>&1"
      2⤵
        PID:805
      • /bin/sh
        sh -c "crontab -r >/dev/null 2>&1; echo \"@reboot /tmp/jaffacakes118_e92eaa9965b8a86c30a747608d7fc03162669968b4b9502f702556f34f478b64\" | crontab -"
        2⤵
          PID:806
          • /usr/bin/crontab
            crontab -r
            3⤵
              PID:807
            • /usr/bin/crontab
              crontab -
              3⤵
              • Creates/modifies Cron job
              PID:809
          • /bin/sh
            sh -c "command -v php >/dev/null 2>&1"
            2⤵
              PID:810
            • /bin/sh
              sh -c "command -v nginx >/dev/null 2>&1"
              2⤵
                PID:811
              • /bin/sh
                sh -c "which apache2"
                2⤵
                  PID:812
                  • /usr/bin/which
                    which apache2
                    3⤵
                      PID:813
                  • /bin/sh
                    sh -c "which httpd"
                    2⤵
                      PID:814
                      • /usr/bin/which
                        which httpd
                        3⤵
                          PID:815
                      • /bin/sh
                        sh -c "iptables -I INPUT -p tcp --dport 54311 -j ACCEPT >/dev/null 2>&1"
                        2⤵
                          PID:817

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            tmp.zTB76A
                            • Path /var/spool/cron/crontabs/tmp.zTB76A
                            • Size 267B
                            • SHA256 fdd019673a238ee70d02683f33ffa361f58e8866db327c948eff5759bb2df837
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download