Overview

overview

10

Static

static

10

3291432c00...kes118

ubuntu-24.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3291432c0084225333ee57320404e655_JaffaCakes118

  • Size

    611KB

  • Sample

    240729-cl4dlssbpg

  • MD5

    3291432c0084225333ee57320404e655

  • SHA1

    96a637393566a51222a87f3588b01e021faac651

  • SHA256

    2409fb21fe377f7e12dda392f26d7c93b7715239169d362dd907fe499ab38ee9

  • SHA512

    d86e86246063a6bb4d7c09d5c4e52af5904458b489b7dc21b0c795b32981482545c4a7f757892a2a2fec7af092986480642e8990e74f12ec6e26a17e328535cb

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr/T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN/BVEBl/91h

Score
10/10
xorddosbotnetdownloaderlinuxrootkit

Malware Config

Extracted

Family

xorddos

C2

http://aaa.dsaj2a.org/config.rar

ww.dnstells.com:443

ww.gzcfr5axf6.com:443

ww.gzcfr5axf7.com:443
Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target

      3291432c0084225333ee57320404e655_JaffaCakes118

    • Size

      611KB

    • MD5

      3291432c0084225333ee57320404e655

    • SHA1

      96a637393566a51222a87f3588b01e021faac651

    • SHA256

      2409fb21fe377f7e12dda392f26d7c93b7715239169d362dd907fe499ab38ee9

    • SHA512

      d86e86246063a6bb4d7c09d5c4e52af5904458b489b7dc21b0c795b32981482545c4a7f757892a2a2fec7af092986480642e8990e74f12ec6e26a17e328535cb

    • SSDEEP

      12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr/T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN/BVEBl/91h

    Score
    10/10
    xorddosbotnetdownloaderrootkit

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Writes memory of remote process

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit
    behavioral1

MITRE ATT&CK Matrix

Tasks