General
-
Target
d1b5b4b4b5a118e384c7ff487e14ac3f_JaffaCakes118
-
Size
611KB
-
Sample
240907-mewejaygjn
-
MD5
d1b5b4b4b5a118e384c7ff487e14ac3f
-
SHA1
038b7e9406fe5cb0a0be8f95ac935923c6d83c28
-
SHA256
0a312a4154dcec2bc6ce1d3b51c037b122ace5848ec99c2b861ab6124addae9b
-
SHA512
20885f782beeca1712924d6dec7fa474fb2fa7f926d7cbdbdd5f7fa18f6a3ac2bcd5dbd771a80c13c3403cbad05f2cda86ffefdc8170d6cc0f0b4b01a5baec74
-
SSDEEP
12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiLx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhLfNiGQl/91h
Behavioral task
behavioral1
Sample
d1b5b4b4b5a118e384c7ff487e14ac3f_JaffaCakes118
Resource
ubuntu2404-amd64-20240523-en
Malware Config
Extracted
xorddos
http://aa.hostasa.org/game.rar
ns3.hostasa.org:3309
ns4.hostasa.org:3309
ns1.hostasa.org:3309
ns2.hostasa.org:3309
-
crc_polynomial
EDB88320
Targets
-
-
Target
d1b5b4b4b5a118e384c7ff487e14ac3f_JaffaCakes118
-
Size
611KB
-
MD5
d1b5b4b4b5a118e384c7ff487e14ac3f
-
SHA1
038b7e9406fe5cb0a0be8f95ac935923c6d83c28
-
SHA256
0a312a4154dcec2bc6ce1d3b51c037b122ace5848ec99c2b861ab6124addae9b
-
SHA512
20885f782beeca1712924d6dec7fa474fb2fa7f926d7cbdbdd5f7fa18f6a3ac2bcd5dbd771a80c13c3403cbad05f2cda86ffefdc8170d6cc0f0b4b01a5baec74
-
SSDEEP
12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiLx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhLfNiGQl/91h
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload
-
Writes memory of remote process
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-