Analysis
- max time kernel
136s - max time network
156s - platform
debian-12_mipsel - resource
debian12-mipsel-20260513-en - resource tags
arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem - submitted
25/09/2026, 00:00
Behavioral task
behavioral1
Sample
jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin
Resource
debian12-mipsel-20260513-en
7 signatures
150 seconds
General
- Target jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin
- Size 27KB
- Sample260925-aahawsztfs
- SHA256 39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593
- MD5 4e7b21a58f46ab284f5323b2398069f7
- SHA1 5d60844c1d5da5017ee09c8617ea0e569170976b
- SHA512 b9befb5a1407bb9b2838cfe4d10d4d33725a73a5dfc0285fd4b1a890cc60b9d4a474d8ca8fa09ac0d898d8114137386b7a624cf6713b717b3d2d2a4e3b84c75b
- SSDEEP 768:xfewuRj5T0D6w6EVTrcxQQwH4fQbZWVrFWU:ZNudFZw6EV3cxQQwG/RD
- TLSH T1F4C2D1FEE1E81545CD7C34BED4AC83555A4C308332DD56F86B1148C1A32A60AB9C11FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
BOTNET
Signatures
- Contacts a large (111866) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for modification /dev/misc/watchdog jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 801 jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin -
description ioc Process File opened for reading /proc/23/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/13/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/11/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/12/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/112/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/5/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/22/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/34/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/214/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/405/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/678/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/16/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/29/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/136/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/709/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/779/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/24/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/30/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/47/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/59/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/766/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/774/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/201/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/4/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/37/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/42/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/677/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/48/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/111/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/379/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/446/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/793/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/795/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/806/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/3/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/9/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/17/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/32/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/380/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/35/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/116/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/761/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/27/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/7/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/394/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/802/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/1/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/15/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/25/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/110/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/792/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/53/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/58/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/113/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/663/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/21/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/26/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/137/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/332/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/404/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/815/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/8/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/18/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin File opened for reading /proc/19/cmdline jaffacakes118_39e6e246d8386ca4bec73d311c133302e3b503a0260c5191ff9c5bb4ae25e593.bin