Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
30/09/2026, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin
- Size 53KB
- Sample260930-pbt4eawere
- SHA256 82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32
- MD5 e3318e75b16d8c42121a45f8d5077f41
- SHA1 0da0fd0865c616ab7573f6f36ebe74b363d19c54
- SHA512 56e9f2559425715eb5b4b45cb1d7b9dcc8791d9eeff11a9099fe97e104e020fb08c4fd9527db3428b1fb93aed049bc705b5ff3c9064dd171a897512aa17f01ef
- SSDEEP 1536:IOEfisOsv9soj+fpxZWwTYaRs1htfPCIUYw8sk0:Qfiov9Nj+fWIKfPsYw84
- TLSH T122332A172661C0ADC416C1B0B6E7E2A7E831713C62F5F46C33D2BF29AEB95680D5A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1512 jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 50 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/962/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/343/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/466/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/627/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/929/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/996/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/247/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/532/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/682/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/690/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/695/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/948/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/968/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/985/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/279/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/439/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/556/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/981/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/988/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/990/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/338/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/480/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/729/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/921/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/477/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/724/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/735/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/926/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/943/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/473/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/476/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/484/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/497/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/503/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/671/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/626/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/429/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/492/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/494/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/507/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/513/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/573/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/587/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/496/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/501/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/535/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/542/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/670/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/673/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/919/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin -
description ioc Process File opened for reading /proc/1545/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1550/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1728/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1758/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1775/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1776/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1117/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1528/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1567/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1600/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1667/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/695/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1597/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1648/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1653/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1677/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1715/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1064/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1673/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1688/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1728/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1568/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1593/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1661/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1697/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1760/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1362/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1596/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/929/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1530/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1117/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1551/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/626/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1286/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1662/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1721/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1732/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1752/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/494/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1532/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1594/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1601/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1617/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1642/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1729/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1771/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/573/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1033/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1051/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1790/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/477/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/670/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1532/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1551/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1598/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1655/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1680/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1686/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1674/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1005/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1084/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1089/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1563/maps jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin File opened for reading /proc/1735/cmdline jaffacakes118_82bfbe24e499275a8209331fba768812091efc7278300c072b332317f3806f32.bin