Overview

overview

10

Static

static

10

6387622dc5...kes118

ubuntu-22.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6387622dc599a220749b77411a56d13f_JaffaCakes118
  • Size 604KB
  • Sample240729-13tshatamq
  • SHA256 74ea918b27f1952f47ab52e75de09f623e29928301da16ac5c27bd5ef8475520
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddosantivmbotnetdownloaderlinuxpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • 103.25.9.245:8008

  • 103.240.141.50:8008

  • 66.102.253.30:8008

  • ndns.dsaj2a1.org:8008

  • ndns.dsaj2a.org:8008

  • ndns.hcxiaoao.com:8008

  • ndns.dsaj2a.com:8008

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      6387622dc599a220749b77411a56d13f_JaffaCakes118
    • Size 604KB
    • SHA256 74ea918b27f1952f47ab52e75de09f623e29928301da16ac5c27bd5ef8475520
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xorddosantivmbotnetdownloaderpersistence

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks