Overview

overview

10

Static

static

10

a99c10cb97...kes118

ubuntu-24.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a99c10cb9713770b9e7dda376cddee3a_JaffaCakes118
  • Size 611KB
  • Sample240819-e8meqavbka
  • SHA256 92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddosbotnetdownloaderlinuxrootkit

Malware Config

Extracted

Family

  • xorddos

C2

  • http://aa.hostasa.org/game.rar

  • ns3.hostasa.org:3308

  • ns4.hostasa.org:3308

  • ns1.hostasa.org:3308

  • ns2.hostasa.org:3308

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      a99c10cb9713770b9e7dda376cddee3a_JaffaCakes118
    • Size 611KB
    • SHA256 92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xorddosbotnetdownloaderrootkit

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Writes memory of remote process

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit
    behavioral1

MITRE ATT&CK Matrix

Tasks