Overview

overview

10

Static

static

10

3b614f5f81...kes118

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    12-05-2024 17:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b614f5f8145fa12d8ab1adaf46dd252_JaffaCakes118

  • Size

    647KB

  • MD5

    3b614f5f8145fa12d8ab1adaf46dd252

  • SHA1

    cca3b65a7f388f74b34d149b90c73411783a2e4e

  • SHA256

    ed03a03a98f1b157c0b2eda15f9669f3e2f24262d329313542d9a4e6e34188d4

  • SHA512

    6507ce97950bb4bcc0f628192d6f0a4aa9e3071f6dbb899e57218671ccc2a13703fad009ca152fb72b8528649c5c548d1e286b8f52045de472d436b33116ee05

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Ton3p6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1m36wvnDWXMN

Score
10/10
xorddosbotnetdownloaderinfostealerpersistence

Malware Config

Extracted

Family

xorddos

C2

http://info1.3000uc.com/b/u.php

benniaogg.benniao.date:2000

8u.yesoday.com:7770

8u2.yesoday.com:7771
Attributes
  • crc_polynomial

    EDB88320

xor.plain

Signatures

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos
  • XorDDoS payload 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 31 IoCs
  • Reads EFI boot settings 1 IoCs

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 10 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/3b614f5f8145fa12d8ab1adaf46dd252_JaffaCakes118
    /tmp/3b614f5f8145fa12d8ab1adaf46dd252_JaffaCakes118
    1⤵
    • Reads runtime system information
    PID:1431
  • /boot/jpteolpijy
    /boot/jpteolpijy
    1⤵
    • Executes dropped EXE
    • Creates/modifies Cron job
    • Modifies init.d
    • Reads runtime system information
    PID:1436
    • /bin/sh
      sh -c "sed -i '/\\/etc\\/cron.hourly\\/cron.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab"
      2⤵
      • Creates/modifies Cron job
      PID:1448
      • /bin/sed
        sed -i "/\\/etc\\/cron.hourly\\/cron.sh/d" /etc/crontab
        3⤵
        • Reads runtime system information
        PID:1449
  • /bin/chkconfig
    chkconfig --add jpteolpijy
    1⤵
      PID:1445
    • /sbin/chkconfig
      chkconfig --add jpteolpijy
      1⤵
        PID:1445
      • /usr/bin/chkconfig
        chkconfig --add jpteolpijy
        1⤵
          PID:1445
        • /usr/sbin/chkconfig
          chkconfig --add jpteolpijy
          1⤵
            PID:1445
          • /usr/local/bin/chkconfig
            chkconfig --add jpteolpijy
            1⤵
              PID:1445
            • /usr/local/sbin/chkconfig
              chkconfig --add jpteolpijy
              1⤵
                PID:1445
              • /usr/X11R6/bin/chkconfig
                chkconfig --add jpteolpijy
                1⤵
                  PID:1445
                • /bin/update-rc.d
                  update-rc.d jpteolpijy defaults
                  1⤵
                    PID:1447
                  • /sbin/update-rc.d
                    update-rc.d jpteolpijy defaults
                    1⤵
                      PID:1447
                      • /bin/systemctl
                        systemctl daemon-reload
                        2⤵
                        • Reads EFI boot settings
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:1455
                    • /boot/sdjywteduu
                      /boot/sdjywteduu "netstat -an" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1453
                    • /boot/xzcirtjxmi
                      /boot/xzcirtjxmi gnome-terminal 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1498
                    • /boot/hqcmdklxfq
                      /boot/hqcmdklxfq "cat resolv.conf" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1501
                    • /boot/rimcrspcuq
                      /boot/rimcrspcuq "route -n" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1504
                    • /boot/rzowklutxq
                      /boot/rzowklutxq "route -n" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1507
                    • /boot/tescxaqpks
                      /boot/tescxaqpks whoami 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1510
                    • /boot/ixgufxvrgj
                      /boot/ixgufxvrgj ls 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1530
                    • /boot/xpltdwwppa
                      /boot/xpltdwwppa id 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1533
                    • /boot/bosgtomarb
                      /boot/bosgtomarb uptime 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1536
                    • /boot/ncsvbrvvqz
                      /boot/ncsvbrvvqz bash 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1539
                    • /boot/zzhbsolekn
                      /boot/zzhbsolekn "sleep 1" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1542
                    • /boot/vzthnoamki
                      /boot/vzthnoamki bash 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1545
                    • /boot/mlvzcihhkl
                      /boot/mlvzcihhkl "netstat -an" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1548
                    • /boot/brgxmufkrf
                      /boot/brgxmufkrf uptime 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1551
                    • /boot/hbyzwezfvk
                      /boot/hbyzwezfvk top 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1554
                    • /boot/lshljzgbgl
                      /boot/lshljzgbgl pwd 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1582
                    • /boot/lykimcovjo
                      /boot/lykimcovjo su 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1585
                    • /boot/eozkykrcig
                      /boot/eozkykrcig pwd 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1588
                    • /boot/zwadnvmdhd
                      /boot/zwadnvmdhd "ps -ef" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1591
                    • /boot/nfanxjbpbp
                      /boot/nfanxjbpbp "ls -la" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1594
                    • /boot/mbiwvdoxhs
                      /boot/mbiwvdoxhs su 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1597
                    • /boot/jmkjmwhkez
                      /boot/jmkjmwhkez bash 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1600
                    • /boot/drnkseghqc
                      /boot/drnkseghqc "netstat -antop" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1603
                    • /boot/gpegnleasp
                      /boot/gpegnleasp id 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1606
                    • /boot/rumijuuolx
                      /boot/rumijuuolx ls 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1610
                    • /boot/pmzgucnpuy
                      /boot/pmzgucnpuy ls 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1613
                    • /boot/ltfnufbgso
                      /boot/ltfnufbgso top 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1616
                    • /boot/afzecogvrr
                      /boot/afzecogvrr uptime 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1619
                    • /boot/hzklzspchl
                      /boot/hzklzspchl "ifconfig eth0" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1622
                    • /boot/rtgbfnwczc
                      /boot/rtgbfnwczc "ls -la" 1443
                      1⤵
                      • Executes dropped EXE
                      PID:1625

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • /etc/cron.hourly/cron.sh
                      Filesize

                      223B

                      MD5

                      b791b087b1795e3674a9aa765c76fc04

                      SHA1

                      b53f478234ae97f3cdbf2e7fe7ec68d687feb7c1

                      SHA256

                      1c1e9b69cf8021bf7ce1f60dcaa2d31c1e21ed4b6e474f3571da81ffd5a9b69e

                      SHA512

                      2dcc2e478c51cf8118306fd5c744aad7147e368cbc4329db1cc5fac52088a7f3354079ae2b582b270495789e4fb4591538ec88bb5ea40eec646f360bac33bbb2

                      Download Submit

                    • /etc/crontab
                      Filesize

                      1KB

                      MD5

                      025668d5c5556a09e474efb8c86a5386

                      SHA1

                      3946e355c493dae571f427906058d877dd000bc5

                      SHA256

                      442a198f06e95043ad28dd345a2ec9b84799a434425b21ab24eeea6f296915d5

                      SHA512

                      f72df72c05fdcc6e3d11a4dcfe5b48486d391b4d61e25d82f6707b02bcd84b5d0989abf037abebcc6518ca106061de9c8d1b0dd2c2bd0b73649e85617aa15218

                      Download Submit

                    • /etc/init.d/jpteolpijy
                      Filesize

                      317B

                      MD5

                      b30af880642ec739fd4f8e4f147b5761

                      SHA1

                      80a1b4ae9fa2518fe3be1959a81fa288454c1639

                      SHA256

                      617b76b2c6f869c22db3bc9167d9f52dc1b3c541c7d8cdf6ef586a4ac671441e

                      SHA512

                      a9dac19a62448c4609efbf3ea5c21abe11ec5065acb89c99c9275cb1868080a993e58d6bcdecacf715e63e5507ab7b0d5ef608a57d51f22e62ec78f56879f62a

                      Download Submit

                    • /etc/sedEUvfYN
                      Filesize

                      1KB

                      MD5

                      44df62f8c671c9306af920e2839cda53

                      SHA1

                      90db86feb0aa6d41208eeb8097929407d79d95cc

                      SHA256

                      c5c9241274bee45e7e60d8b247a15bd5f69bf821b813215194156fd60fc4afc9

                      SHA512

                      0b86ddc2a648da07820a8ef90c71a54908650f589cc7a6c9ca40d74083909f56cdc68633dca82174ca6ddfd340bbd538bdb3a9ace8ba5031b474a4db01d5427d

                      Download Submit

                    • /run/sftp.pid
                      Filesize

                      32B

                      MD5

                      a4b33ca9fc99459867767f7496402b8b

                      SHA1

                      7c7a508bf380a0f2cc30a186636d740e7d19f599

                      SHA256

                      8b35245636586ed4197df339ee640f26e694b3cb350b8f6a181450314c555747

                      SHA512

                      d1bd83bcc74f7ced5d3d360ede712c92ada848225f050a71ef215c3b34752965232f7c4db9cd6fcdb50fa4a29b352ff11dbd3dd741bb9600cd5fa4b508d7ec8b

                      Download Submit

                    • /usr/lib/udev/udev
                      Filesize

                      647KB

                      MD5

                      3b614f5f8145fa12d8ab1adaf46dd252

                      SHA1

                      cca3b65a7f388f74b34d149b90c73411783a2e4e

                      SHA256

                      ed03a03a98f1b157c0b2eda15f9669f3e2f24262d329313542d9a4e6e34188d4

                      SHA512

                      6507ce97950bb4bcc0f628192d6f0a4aa9e3071f6dbb899e57218671ccc2a13703fad009ca152fb72b8528649c5c548d1e286b8f52045de472d436b33116ee05

                      Download Submit