General
-
Target
c10ffeaf668f69c1124f6cd5fe0dff3b_JaffaCakes118
-
Size
595KB
-
Sample
240825-s7hl2atdjq
-
MD5
c10ffeaf668f69c1124f6cd5fe0dff3b
-
SHA1
99b10f29a401f8846b1b94b0906ff9bad8128117
-
SHA256
292adb2a5917259e10fbfce5e936f993dad8bf1d813e3b9d5d9c9bf4ea4b8037
-
SHA512
1040df753d9a4c27cbcba709a5ac3120a001cac78803103c639c0506bfefa13836910baa391c17dd6123c494dc2fcea0a23202488306b8455eedae3072673f74
-
SSDEEP
12288:9bf8IKMnQXbeyFlGF/5oYAx//tqdx286yNrMu9h7Dxu9hc7L:tf8INobe0kxoYAx//tQ26TzD4XcP
Behavioral task
behavioral1
Sample
c10ffeaf668f69c1124f6cd5fe0dff3b_JaffaCakes118
Resource
ubuntu2204-amd64-20240611-en
Malware Config
Extracted
xorddos
http://info1.3000uc.com/b/u.php
gh.dsaj2a1.org:2822
www.wangzongfacai.com:2822
174.139.217.145:2822
-
crc_polynomial
EDB88320
Targets
-
-
Target
c10ffeaf668f69c1124f6cd5fe0dff3b_JaffaCakes118
-
Size
595KB
-
MD5
c10ffeaf668f69c1124f6cd5fe0dff3b
-
SHA1
99b10f29a401f8846b1b94b0906ff9bad8128117
-
SHA256
292adb2a5917259e10fbfce5e936f993dad8bf1d813e3b9d5d9c9bf4ea4b8037
-
SHA512
1040df753d9a4c27cbcba709a5ac3120a001cac78803103c639c0506bfefa13836910baa391c17dd6123c494dc2fcea0a23202488306b8455eedae3072673f74
-
SSDEEP
12288:9bf8IKMnQXbeyFlGF/5oYAx//tqdx286yNrMu9h7Dxu9hc7L:tf8INobe0kxoYAx//tQ26TzD4XcP
Score10/10-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Write file to user bin folder
-