d2bb809a1ba19c3647dd9f2178ab2d07f69352b1b2969f435654fcb4100e7786

Analysis

max time kernel
146s
max time network
142s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04-07-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26403231703f45be8c951adee6b8f30a_JaffaCakes118
Size

139KB
MD5

26403231703f45be8c951adee6b8f30a
SHA1

6bbbf7134fe1138d8b505fa6895d84518231c807
SHA256

d2bb809a1ba19c3647dd9f2178ab2d07f69352b1b2969f435654fcb4100e7786
SHA512

d83e8f8fb9bbaf5035e5df683757c66bc46bc6fd6520456150a5e57afdec4c8b25b83d4d9a86b5cabcec686f96d9ac675c038142872911504d336fc15fe93fcb
SSDEEP

3072:Cv/WwsLgaq353qHiCOvhOpQqkDQHbeskmhxQwoVSUNu:KPLaq351hOpQqkLskmhxQwoVSUNu

Score

7^/10

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

Processes:

26403231703f45be8c951adee6b8f30a_JaffaCakes118

description	ioc	process
File opened for modification	/dev/watchdog	26403231703f45be8c951adee6b8f30a_JaffaCakes118
File opened for modification	/dev/misc/watchdog	26403231703f45be8c951adee6b8f30a_JaffaCakes118

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

26403231703f45be8c951adee6b8f30a_JaffaCakes118

description ioc process

File opened for reading /proc/net/route 26403231703f45be8c951adee6b8f30a_JaffaCakes118
Changes its process name 1 IoCs

Processes:

26403231703f45be8c951adee6b8f30a_JaffaCakes118

description ioc pid process

Changes the process name, possibly in an attempt to hide itself sshd 638 26403231703f45be8c951adee6b8f30a_JaffaCakes118
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

26403231703f45be8c951adee6b8f30a_JaffaCakes118

description ioc process

File opened for reading /proc/net/route 26403231703f45be8c951adee6b8f30a_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	26403231703f45be8c951adee6b8f30a_JaffaCakes118

description	ioc	pid	process
Changes the process name, possibly in an attempt to hide itself	sshd	638	26403231703f45be8c951adee6b8f30a_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	26403231703f45be8c951adee6b8f30a_JaffaCakes118

/tmp/26403231703f45be8c951adee6b8f30a_JaffaCakes118
/tmp/26403231703f45be8c951adee6b8f30a_JaffaCakes118
1⤵
- Modifies Watchdog functionality
- Reads system routing table
- Changes its process name
- Reads system network configuration
PID:638

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads