Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
18-08-2024 13:55
General
-
Target
a6ea3e2aa4751022d24a8053619bbfa9_JaffaCakes118
-
Size
610KB
-
MD5
a6ea3e2aa4751022d24a8053619bbfa9
-
SHA1
26e14b0eb3c2f7cef909c1e50ac326c06892e5ca
-
SHA256
b52d5c430f6b2d4061ee5ea4bb73289f9ee2da02e8dde46c08a958913252c4f9
-
SHA512
a22ab0be5c822ee569e6d62289c5cd30b2559777c5e4783cfc647b55bfff336de095114101a1da6e875eb51ebb13dcb7d8aebb534192633853a912454ab38451
-
SSDEEP
12288:kBvdieCWYsnxRQfx8HH70AlhEaLbljkj8O7Z/Yx6y9lSNU4UlUuTh1AG:kBveWDbQfEHtlh1LbljxPrMNWl/91h
Malware Config
Extracted
xorddos
ndns.dsaj2a1.org:3504
ndns.dsaj2a.org:3504
ndns.hcxiaoao.com:3504
ndns.dsaj2a.com:3504
103.25.9.245:3504
103.240.141.50:3504
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes
-
/tmp/a6ea3e2aa4751022d24a8053619bbfa9_JaffaCakes118/tmp/a6ea3e2aa4751022d24a8053619bbfa9_JaffaCakes1181⤵
- Writes memory of remote process
- Loads a kernel module
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229B
MD5eb3aa38df5d98249f05687bd58ec5aa9
SHA1fc35c059d8594e57f095d50ce7fe3e4ce467a7a1
SHA2566d65d0f293c413396954a07244e036fc80a64d8e33f123375530e73e0557b60c
SHA5126b409a48424cbe5b3f9a3e05c5784122e286d65152dfe62ef78c4202840cbf6c5dfee19d0b9ac9d58a3fba8ea69518368430ed2f6c959c261dc1a9a19322923f
-
Filesize
495B
MD566fafe3c3a313d02f5781922d8228c1f
SHA1db2a0cf86b64c162073c2007005ad84feaed4d86
SHA2562bbc053e8585387fc784fae92f155118e255a997549a800bb88f726ece1eabb0
SHA512a0974c124d3395a2b820b819c464a54bf1ffb818fa632648df4142c6f36072b4f60732c31b9ff6510b51eee376564426192f946dff9b793d673fffad1cd096b9
-
Filesize
32B
MD58f0486a5fb6ddca26da4f132f5491a74
SHA167579696bd710fd19648ac631cc66fa67fb100b8
SHA256280fc1510f4daf6296ae0e12c26dc708fa2ecda1b34544751bcf4a3aa1d0d7e1
SHA512107f46dc05da9172e80c03a1f8d24cd0d3108f8e6084b6ea4ee17df9d2282f4a3025db482db642b4ef2dc1b0db766de8378bf313ed1662e5d7b2fe28fbccec89
-
Filesize
611KB
MD55859424e43d34be25b0e50b75aca549b
SHA14e85001ef6ce8d1141c6ac09f87832a8f9bb77b9
SHA25693f31174a0a402c200ec9ca0e4285f080c75200a6c982ce8cff9d32010eb7abf
SHA512b33affb9312f4941bd0e5fddb081f9289c64915ddc658a42cae9fc8b4f7e6bd50ad729b8352cdda9163c315150501edcb37e6ef668003ec245b4d57a7c929574
-
Filesize
611KB
MD5ea00a8db47ba0964e8412ea4efaadf5a
SHA16138a9e999772f6065ca74c5a943c84d44feb20a
SHA256a80950b00b8d81e5774d5a9ba24aaab7dfbec2570ecb831c2aa21b73e52ee43f
SHA5123b494f5548aa03b222fe92eb73c242e45b214f81058da7c839a4df8b24de79868213e63c19bb7c13e00ff3045022a43f8d01af23485525819cc64daf50e6d088
-
Filesize
611KB
MD5e5f10d9da909d36d046067232d773c7c
SHA1ea10615600f4b85bdf8073f59ad27d7815cbe830
SHA2560203dcfb2e6634cd3dae8b7db4e2b8eb14bf6cdef9302d80e7dcafc2d934770a
SHA51293d2c72fb37ad323e2c7edd3b4507231fcc4289e45da4dcba71d7a234b721287f18755414b0a3c0584f7e6c912943b01427bdb058afb2632664352bce144a55f
-
Filesize
611KB
MD54ef2609e321ddf2674ef84dcd2849a8e
SHA11a19f6f36ad3a0cbe89d7b7b2b20f854e30ec676
SHA2567fa7be946085e00244773df91ebc187ca51e093f8813a4a753d1e0e3666529b7
SHA512c2f91ff94c0df26bd6f00de631cad528be6d2e1bf8fb2e4634e35119ca73f7dd46e71da12531268b7d3408cdff75775656b4407fcacf1ad6240edc96dbc5c3df
-
Filesize
611KB
MD51e8377f3b9ed89d1a674eb340f9dd470
SHA19f7fe6370b0ef7083f435a1bf98ee0a802e933f0
SHA2569c607d035aac6dc7f1a60b9246829dea6b6989101d46b1bfdb2b2b63c9aee529
SHA512037b2a1cdcf5bc63a754e424b6e2b7b63bc9743070c27bf83b6a3c46ae4ab64367a5db4a27b682dc064f1ea346e985859acd1c5f41349ae6d22219ac6d42fa15
-
Filesize
611KB
MD5df33a993b622889574b85690a80ae344
SHA137cf1b939429cc2d9123cc922d4f3f5a08041a4e
SHA2563f4848ab117bfc9025ca4a707a07daede0f8a79d57c96d70e05c83cbbbd8b5e1
SHA512d565ea16a8ba984c22e05a73bdf3687274fc39cb1ed6b40f5aa35d26719ba92cda55f035a38e05307f8f7b799f9aa1b9945e0f05518917a60d06cdff97823cff
-
Filesize
611KB
MD5647c7b23261a07d1052ed25c149f0e51
SHA10818b5736835713c27049e7b1537f19cbd0719ea
SHA256be06ece8a105744224c12ccd6d08cd5142979d70d5fb60e96fd5f7a1dd3dd5e6
SHA5121c018e4d020dea633ee42e693d021220e8a48cc4302325319d42b7bcd07fb2aecdee257df591d5593011293b43046fc6349d8c3bc0933405b9fb9999540e7c88
-
Filesize
611KB
MD51d24a8bb5f7675b4ee7e96e5d415eb94
SHA14753646223891eded146faa8d84b47836460d992
SHA256567685ca28a179428310266108af858b7202a4a7415c43f336d1dfdd79dfcf1d
SHA5128cae0f496757ce1d8fe2d9630efd9e12e6694a9d9fd60c21c717e50caca473d9f98abfff8df9435046bc2357f896c784af6b9fe7d54f3be3db90c5dcdd5727f0
-
Filesize
611KB
MD55da044cf7703cd0b9ec55cb8a30c870e
SHA147479074db03034f3b40d99cb14142fb8641e830
SHA256943b547c0f9d46867272654816bdea01ecc80c8f84a6794665ca8cdb242e3bdb
SHA51215fb6b7eda730620da6d50d58b0190d6c6efc21e1a528649ad062dc4b8c6d52ea9aa55a4c0e84b821a01f01e0c0c10934500d9eeffa172722650e67873404212
-
Filesize
611KB
MD52582cee5581b433a4f2e478a0d9255e2
SHA1064d5653e41936e7f25f9904d7f850e8d1a79121
SHA2565deb4af0775b52c66d3d9dfcd6af602fa675b0cdee17f570cada467beb4113ba
SHA512c359d3815b5b22c52f9aa099bc25d0a9280cae667239b2c9ac5f2f899b43bb282bd7d2b30d5cae31c85160893947a1c9b59add168008a264bf3a9af3fd59cf88
-
Filesize
611KB
MD53e6b01d3fb7712af8f34f32c57b0655f
SHA19bfce6da09cc2e4dbfba4ba4aad9da0722a1fa9f
SHA25614a8650e05645ea5c835c30b3c7eb82216d16ee3cd2f34dbc75639fa014cd500
SHA51247c27960dee939ffd895b764e019603a561a885c940fa231e3dad2a5bf8eaa71a389d96dc278beedf3249d61809a5b85f73a98e45f271838d1b8241e4b430c78
-
Filesize
611KB
MD5ed922135f5064b4e0c7f905f443526cf
SHA1adfd716834d8a75cb865165b5ee8ab6d69c2dda2
SHA256e67bea572c127fcbae8f4b284e819ea6a90fd5b0f375764a3040c26e8d36c9b2
SHA512294f7dd2222192c7d290e1a154522aceb114e316d2aa3c34f2fd5a48f913a2b429866afd88978850ce3916ffc802948545b7dba8ad04d1008441875b0b3517e9
-
Filesize
611KB
MD54ab693cfec8298c1ec09b77e97925c9c
SHA1f66893a03bdb3951ba680bcae153becb8abbbd11
SHA256e604c2582bb00317948a7ce45433fdd59c12057ef47ee43970528237319c9f98
SHA512a6d1825dfb5a3e8ff0ecf6408f0f9e7f1a9a8e2ec5963056f7efda9cf41a08462396581ffcc51b06446a10671b2a44b6b5e82f066293fa00f41d5197eb48b54b
-
Filesize
611KB
MD5211153ed604ea21c8ec44cd5f5f085d6
SHA1885d2c20da2ca1dfee3c44cae3002e72cc7f6670
SHA256103343ca230f0d17bd3ef944294b1d6a9a9adc7702da060a328b1ba48aae2d78
SHA512fa784914cee413f433bd865d23168733498d62fbfa889cfb24c60795959a9899f01d76b4744c7d9c1b15c3dacd6e629aa83ddaa9b29ea10e83a7a1422083c697
-
Filesize
611KB
MD5c76cfa8b849fe0b60d3b0affd9568621
SHA13078c0350816a22b7428b6d6c04f6d0f4ee3ebc6
SHA256f38c14d51fbda778f6953cc087c2b207e9467d13ee14edc33c0cb7abb473fbcd
SHA512f265bed31f6be6d3f499895208ebabd1a7b5ac70877eb0da954673f96c192350eeed7ee5c553309f4b0912c6dbd36ff879eb31fb6ff5b302da62dc7ca96b9fe3
-
Filesize
611KB
MD5ed6f627f830b2c520ad30a890be5bbd3
SHA1b63f403b5cf9b68753b81251040504963fa0c164
SHA25670ee3f0a0c39f7cc8148f6fa02b1eba5273d2c2386f7597ec178235ec6689684
SHA5128b3d82b76eec5f080cf9d2a0db6f0f0ade28af05f02093c1b9461174c147cc9b2d7e66a33698ddd6e3de8610f61a3d8c4868cd44f358f698b0c8dc28f47ff453
-
Filesize
611KB
MD5bc9a43575317233791906d014e4634a2
SHA162aa1a610f371279d6a688b4036db85d6a19cea6
SHA256240d7c1afdce0609143d667608e1d6bba02610fd3d37250f9d9863eb918d69e7
SHA5126c752814da0c5c22075dbaf508cb2f16fed02ca2e314e04a92ef0e08828d98aef5df6fe04d7879fee93263cd7ac9f0c01bf3fc40a479a3d9c9b4b05ff021fcc9
-
Filesize
611KB
MD5b6b0fa57e85e65bac710431b00e72a80
SHA11fc9e37b73b8eea23df4c08622a245efb2050e9f
SHA25623c7377bb2fde876ff1712c1fc0c3f10cad74e189af07e7804d05023ae5d73ae
SHA5126c0d1afedfc0afc4ca8ff7b91cbcf8b5a17923b192674f194f43d6d0f201d9b31bc1203284c4382e5f02249ad45354dbf58f4f369d3c81322f3523af75528c02
-
Filesize
611KB
MD57bf4ad9c5be0c3f93194c280497619ed
SHA1449a6d65a438b4c4b90fbb6ca07e0b574f8751cb
SHA2568d81c2b1a118eb3e0a57e9c8b57e65ed648b6300323a5bb3777b4f9e833bb97d
SHA512379a7b4040d53690b01c84529b58f1c3fdf445774d0085bedf17254948a92bdd74e2a622116b3f2818ee7b856267d22964eebfe17be28debf4edf5e599fc6758
-
Filesize
611KB
MD50c198c95f73f795ac38fe0c47b390341
SHA1ca9d3f5215f45ed2c4f20d1d818496e20197ee55
SHA2569e1aa3f46c6d5f199d8c5cb5190e600de926f05f154a8c579dc7f64a5240642a
SHA51282be5f358be3d53527e1ae7dcc54781a3b6c8918b7fca4d99879e5134f3b24984b4ab7f5675c498c9a1f51daa9e77b70d543030a0bf1354b4ac1e9c2c104fffd
-
Filesize
611KB
MD561f2be1f6842209913ebbdc1c6137ee8
SHA138b6a9e1a0eca0999272ac7ada267c4583b28ca9
SHA2560db4b1849722a5b2b394c8f5ca9d436c86ffb2cd29784d448d040057548f06ba
SHA512e296738e31cd309809304f642745ffeb63d202bfcbf084576dd0c25e965160bead34758ee7521695af29bf173745329863502d16eeb52b80f4a9e5ba5ef5c16d
-
Filesize
611KB
MD58ecefe547a583d2affee97d4a3e5727a
SHA1a9eefdba1ff7bad84a41bf4976bc0c27960791ae
SHA2565509a601a202e0d38852675cce735cdc55de9ba1e5d33cba02576652e93ee7ef
SHA512ecece0acfc1d6d7c496de52aafcc7064aed8afa0816d7f8639e6bafbbf33744b4d2f5b5f53b72fe4d632f246a706139de7caf010e6bd88c9762c71a1f77ab852
-
Filesize
611KB
MD5380174211300c5f82de16745e822be19
SHA1a119fe1cf5625221f2c5b478185703c5361732e8
SHA256ea3d849f0e1618775725dce6150939a01f3b14d1c25b69018f9adb9b2dedfe3e
SHA5129c862a3cb442c161f316d1c730e64bf4e060a880b1036caf2fd6636f82b42f019f56d8fb121b2fbfeab67bf2df66a7aa1598f81ea740a3c71e40208aa6fc8589
-
Filesize
611KB
MD550f28ec9be6b90d8e6e9d557043fd0a9
SHA1a9d78ac9ad33ba9e5329ac4e60ea91d75379bd76
SHA2565b7cdf1d85573845f2c68d5d2af3333759b0c395b8e94bec5e27b8b46a9fc2bf
SHA51219c63f1202781ff9a64ac678fb113052baaa510c4e4547dee00ce12b12ae23510345473c1ecbf8f97471724cf8be943e9873a2cdb03431335c9aa649d126fd36
-
Filesize
611KB
MD5d4c1f28f8993c5282e059b1e8a260c25
SHA14f79b9883fcea3a65079d6b0fe322596b8ef1110
SHA256a3cb4744c8415edbfcae23d3eda9714b49b3f60cb999580d4650c30c2fc426d0
SHA512c1b5a90c4419d28dd5468d98ecea34b93beb889624cd502e702d4af388abc7ca344c99a19ef9a732006d97a42d4329db43bb25d47fe49806826251af5c7b9cc1
-
Filesize
611KB
MD515a643ea269ee9845b1b38ac8b3c4fdc
SHA17444bac4be4b736e41aa9fc364a7ba29447ed9fa
SHA256598a821aab8e201f5a40968e40256e485f3c05f8f4ad317b8fa691cb2b355bca
SHA51272292aa374d56a5db3fbb317ab70ccf3450250f455664b7fe97b949fb5e2b69ae7e0be94e3f5850313b64eb88a3d42214d9afcab193014d94cd056dfd1bcf436
-
Filesize
611KB
MD5e8c339fc2cb24247687590a3f25c250c
SHA1b49e244a457c2eccdf1dcc1233f8f88d7f2c33af
SHA256795047d88636de90694bee24cd78019a3b53509ce8be12759958a60e6fe5ee04
SHA512bfb291616cfb69934104d9a19c435cdec6f8824729ec26062960a8e1c1086027d126e770d8afb15f61010b70efda1809bce25255c8f61a1cf47681f2e2235770
-
Filesize
611KB
MD5759deb5feb9115b98284e5e0b27400f8
SHA1246e5bda8cdd584666f8c23d3c986bba7d301d05
SHA256e0def4f2ad65e27796e2f45a6da09f09ad46e5939fb658727806915e22f1eebb
SHA5129831381f5e5bd63586922d2eab807b3ffe0afaaedfc5b58753373d82fc9d17b8e5eacf57742fb4e71010e1e226b55501a5cb470a67e096ece0a92f26d037657a
-
Filesize
611KB
MD535b25fe41ae24615787b3730ae998b5d
SHA197254fa75c910452d5485a502381700629eab76b
SHA2563ff9876a19500e1271ba675f02344a4eabb85572463a02af69450e852ef0b2a8
SHA51233fbbf4a9539fc407a41735fa03dfc153eac5987cc1dc5f36e3aa9bd1e7814aae299bd67665efa87db312caf9c957fd98d5155c8a401ab341f29e7ac58bb769a
-
Filesize
611KB
MD5eaa3cfb52ca9148698c8ddb0835b59bb
SHA10293b6c8225baeb7160ee1d48d27c3a21317395b
SHA25666f739167e478f485e95ac394735d92781330b8b9d5294bec8d0df6d7fb57a25
SHA512d4b8be6884382d2f508b5a4804273c442ad8a4308ec01eca473a9ca4763091bd48689eaaecc23db5af1666e6c528a35fbef2673e3ffe2337b8516fe4e1b4fa0b
-
Filesize
610KB
MD5a6ea3e2aa4751022d24a8053619bbfa9
SHA126e14b0eb3c2f7cef909c1e50ac326c06892e5ca
SHA256b52d5c430f6b2d4061ee5ea4bb73289f9ee2da02e8dde46c08a958913252c4f9
SHA512a22ab0be5c822ee569e6d62289c5cd30b2559777c5e4783cfc647b55bfff336de095114101a1da6e875eb51ebb13dcb7d8aebb534192633853a912454ab38451