Overview

overview

10

Static

static

10

3b68ff7b76...kes118

ubuntu-20.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b68ff7b7620057a246d81f646d41287_JaffaCakes118

  • Size

    611KB

  • Sample

    240512-wqvrtace46

  • MD5

    3b68ff7b7620057a246d81f646d41287

  • SHA1

    ae0d33b69684d2e095c4b5622344f69dd12ca553

  • SHA256

    8ed19e85a5cd5fb0106e4066523fed1f8b100ef0ad557198fba10749cafabf1e

  • SHA512

    08b0029b7a7a805b4500dd12753afc0ad3a6be494d8d29a560567692ac1e841a7117ccfb70d643df469147dd42200372ade6a403c004bb07c3093de1136dd31a

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrruT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNuBVEBl/91h

Score
10/10
xorddosantivmbotnetdownloaderinfostealerlinuxpersistence

Malware Config

Extracted

Family

xorddos

C2

http://www1.gggatat456.com/dd.rar

ppp.gggatat456.com:6001

ppp.xxxatat456.com:6001

ddd.dddgata789.com:6001
Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target

      3b68ff7b7620057a246d81f646d41287_JaffaCakes118

    • Size

      611KB

    • MD5

      3b68ff7b7620057a246d81f646d41287

    • SHA1

      ae0d33b69684d2e095c4b5622344f69dd12ca553

    • SHA256

      8ed19e85a5cd5fb0106e4066523fed1f8b100ef0ad557198fba10749cafabf1e

    • SHA512

      08b0029b7a7a805b4500dd12753afc0ad3a6be494d8d29a560567692ac1e841a7117ccfb70d643df469147dd42200372ade6a403c004bb07c3093de1136dd31a

    • SSDEEP

      12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrruT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNuBVEBl/91h

    Score
    10/10
    xorddosantivmbotnetdownloaderinfostealerpersistence

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Executes dropped EXE

    • Reads EFI boot settings

      Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

      infostealer

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Boot or Logon Autostart Execution

1
T1547

Hijack Execution Flow

1
T1574

Privilege Escalation

Scheduled Task/Job

1
T1053

Boot or Logon Autostart Execution

1
T1547

Hijack Execution Flow

1
T1574

Defense Evasion

Hijack Execution Flow

1
T1574

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks