General

  • Target

    a15e9d2d69c1407ac5b42ba46d71fc58_JaffaCakes118

  • Size

    603KB

  • Sample

    240817-f93zjasgmm

  • MD5

    a15e9d2d69c1407ac5b42ba46d71fc58

  • SHA1

    5a124a3a2f363bd3740ab792044d9a06dc4256d5

  • SHA256

    7aa8eab2f01783bfe9bb7d8e051baebf563629645d73b2af42022d28a8143179

  • SHA512

    f38eeae08e03f19339d03b01a271df14284bd22194887b492c24f6e4c89ef7b416507350cab6a5de8d90084519703b78cd844f35a54a4fa13b8643f0c6a395c5

  • SSDEEP

    12288:R40XBrnlTCbI5ZBP5IePtqLn4yFeC+oT6ygF9b4elMuThmVF:e01tCbqNNPtqLn4yFmoEbdlH9mn

Malware Config

Extracted

Family

xorddos

C2

http://info1.3000uc.com/b/u.php

gh.dsaj2a1.org:2822

www.wangzongfacai.com:2822

174.139.217.145:2822

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target

      a15e9d2d69c1407ac5b42ba46d71fc58_JaffaCakes118

    • Size

      603KB

    • MD5

      a15e9d2d69c1407ac5b42ba46d71fc58

    • SHA1

      5a124a3a2f363bd3740ab792044d9a06dc4256d5

    • SHA256

      7aa8eab2f01783bfe9bb7d8e051baebf563629645d73b2af42022d28a8143179

    • SHA512

      f38eeae08e03f19339d03b01a271df14284bd22194887b492c24f6e4c89ef7b416507350cab6a5de8d90084519703b78cd844f35a54a4fa13b8643f0c6a395c5

    • SSDEEP

      12288:R40XBrnlTCbI5ZBP5IePtqLn4yFeC+oT6ygF9b4elMuThmVF:e01tCbqNNPtqLn4yFmoEbdlH9mn

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    • XorDDoS payload

    • Writes memory of remote process

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Matrix

Tasks