Overview

overview

10

Static

static

10

3291432c00...kes118

ubuntu-24.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3291432c0084225333ee57320404e655_JaffaCakes118
  • Size 611KB
  • Sample240729-cl4dlssbpg
  • SHA256 2409fb21fe377f7e12dda392f26d7c93b7715239169d362dd907fe499ab38ee9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddosbotnetdownloaderlinuxrootkit

Malware Config

Extracted

Family

  • xorddos

C2

  • http://aaa.dsaj2a.org/config.rar

  • ww.dnstells.com:443

  • ww.gzcfr5axf6.com:443

  • ww.gzcfr5axf7.com:443

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      3291432c0084225333ee57320404e655_JaffaCakes118
    • Size 611KB
    • SHA256 2409fb21fe377f7e12dda392f26d7c93b7715239169d362dd907fe499ab38ee9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xorddosbotnetdownloaderrootkit

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Writes memory of remote process

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit
    behavioral1

MITRE ATT&CK Matrix

Tasks