Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    07-09-2024 15:58

General

  • Target

    d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118

  • Size

    596KB

  • MD5

    d24e975bd11c5e17ce8fa6a5b8ab52ca

  • SHA1

    e83557dce06c238a6c2d04ec7da00d908c90c82e

  • SHA256

    a52428f16f891e1a17375cbee34fdb68c83632988e7b1ae1590bacda2724cc0b

  • SHA512

    16cb95f72708869d75c9e4f63d1cb5fa95ccddb9460fc6a4bc8c3837e46df512a8e4e87bf24e7e9ae9b44357536694fa96308a1436cdb7e6ac1609f192f3dc60

  • SSDEEP

    12288:rPTJS+naeW9kclFEcMWbHdxZ7GkR2fo/6y9P/YAh7Dxu9hc7L:DTJfrW99q4bHdxZ7G1foFND4XcP

Malware Config

Extracted

Family

xorddos

C2

http://full.dsaj2a.org/b/u.php

gh.dsaj2a1.org:2415

pengpenga.xicp.net:2415

61.174.49.203:2415

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Signatures

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

  • XorDDoS payload 31 IoCs
  • Writes memory of remote process 2 IoCs
  • Loads a kernel module 64 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

  • Unexpected DNS network traffic destination 13 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118
    /tmp/d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118
    1⤵
    • Writes memory of remote process
    • Loads a kernel module
    • Creates/modifies Cron job
    PID:2527
    • /bin/sed
      sed -i "/\\/etc\\/cron.hourly\\/gcc4.sh/d" /etc/crontab
      2⤵
      • Reads runtime system information
      PID:2535
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
      • Reads runtime system information
      PID:2545

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /etc/cron.hourly/gcc4.sh

    Filesize

    149B

    MD5

    4bc702c21d7b2bbb32638e37ec6c3943

    SHA1

    6b097d447b57c10f10f67ccd5efac4e4d39ddd38

    SHA256

    f702b3fd1837f30a23c74d5605e0c9cf79a480b942ef7d3bb9f79d448101a8b3

    SHA512

    19523b3e006eaa41a22a6af5ad1d0b23adf7eb5c653e367229b2d6bf69066a7630d637ae4131e5ae98e63434b00f6af5bef4ece54d7ad66d5c92b8f549f5b3f8

  • /etc/crontab

    Filesize

    1KB

    MD5

    d7bd8be873656590bcd306cb9560d50a

    SHA1

    cf3dc20140d87c4e1618174601ccb0c8e4c11aca

    SHA256

    3b2b5851a245091f7c26f611b476d72052f838a1078a3f7dd38f679a33b64457

    SHA512

    0e477701b43ffc8068b0ffc95ef105cdc09e6c856af4535287617e0e27f933d7f3cdbb9b6d95d156a05e554e37f734b40c72c2d709892838a7e8f95b5fe3b208

  • /etc/init.d/d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118

    Filesize

    495B

    MD5

    73afe9cc3ba857a905cfdd1b3f6f9690

    SHA1

    0b34cb28bd1a5549e41dafc8a01885f53bdc55d2

    SHA256

    c2213360f5507d64f8e7d28d9ec0662b229aeed5f8c082b1b097db7caf6ffbca

    SHA512

    281f43d4419e72e3298c229be80b9f605d6cc9ade32b554e82647a24478d5a0131512df3544c0b6d60b30c2fbe81e2951fb0b491fa51530171781bfd6fa27aeb

  • /etc/sedmoJlLm

    Filesize

    1KB

    MD5

    85f7ff2020ac8c72212f076ddf33c0be

    SHA1

    df06ddd9c29e8da5cff1aa356e9529336573422f

    SHA256

    ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3

    SHA512

    d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00

  • /run/gcc4.pid

    Filesize

    32B

    MD5

    1c8a3dff2135abf2d84ba8a5d8711e84

    SHA1

    ebc4632ded90b635ab209cbecaf81d5f7fe5deaa

    SHA256

    87ed6be419a6efc047a3285d779080b301b17f35c9d48d888e70fd80ac473baa

    SHA512

    cf7e5eef7ef12e0b2f65b1fed82eeddd0cb524b5863698a5c1cb623ee0b7295e569768f72620e66579af1766d8d6afba6cc6510eaee239e191aa5f534045d13d

  • /usr/bin/bsyjpdzvon

    Filesize

    596KB

    MD5

    42f8814285b32893b1125b0ac8e97427

    SHA1

    50b3fa90c6666454cd68b204bfcf67501d4fd842

    SHA256

    acddb74be0a722d8eefc9e67752edbac0366aa370859dffa710a8c5fea489b46

    SHA512

    8d9062acf2ade5ac087e192294963cb4674be6d9c2eb6700582569c9d1632190bca278f733b0530a60d8be6ff9421f0cfe9b95520ac6ca1370dc291351703f6b

  • /usr/bin/bvvafwqxxr

    Filesize

    596KB

    MD5

    120c69fdbca40ef762f53cb127797dcb

    SHA1

    fd8354c5eba0f88bb664167c893c74e8d0021ec9

    SHA256

    f1a1d63906a369226021d8848a62556dc22d54ea25c9c57ae0420fc0aa30b367

    SHA512

    e72135cda99611a6e4f38a311aa428303a71a36e0d8ce7f6ec280a2e4e51dde803414a5884e59b8fda6d2c2d186c0fe9e10c4ef32256a12209cc5237e13e5cd5

  • /usr/bin/dwtnkwuwdj

    Filesize

    596KB

    MD5

    a77a3745bda4b930bd5131e8b7bea2e5

    SHA1

    ca2ce67ea3e49c658c173ce3d62f1ea50cd1cea6

    SHA256

    d67e083339297d8768bc1d38273265e22f60b9e89d9b7d53814fdd1d2678d8b4

    SHA512

    817a93534532efc442c693bd91d215783e52b2c0ee85b7fd4d06be983a11d718322c86e268f84873e805d023c8f13a2916e91fb67fb77243b5259ce88d21856b

  • /usr/bin/elnwveeatx

    Filesize

    596KB

    MD5

    65a4ca66bbd038d4dc05dc11835a4443

    SHA1

    513323da3a819d616f1156ec82d14e64294e1880

    SHA256

    8c92f651a08727656e3a33dd30ff7835ec447a5cacc81436375b2d0554d4a18f

    SHA512

    af00c227ca6e652469286ec77923a283c15d2ea3fdd57355e038fea4383d51ad4ba5c89305e3bdb7cdd5b6f7be64189941ccfe022aa0f69d71a76eba80341602

  • /usr/bin/eyxsqodplz

    Filesize

    596KB

    MD5

    bc74d7745d31f1b376f5cd1a11e925fc

    SHA1

    88f283bde70e346ca56619087f1b1eba68388a74

    SHA256

    fc0134be8674759d970746fe55b29c7ed78cb1c48a0c48ab72e55b599ba63333

    SHA512

    af5db10c8e8f34165a4180b6069d945ffad73d8dee7278b51beff0620e156aaaf2f83900828e54e73d02e1089d2fd1f77a83f444271ab1b3ac6140d0b75dd1c2

  • /usr/bin/fbhruzpqtr

    Filesize

    596KB

    MD5

    0a58c4714eb7966a01af7ae5a58df384

    SHA1

    1f39e6c22cc84dc7c5cd6273f58012c1c0991da3

    SHA256

    136352aeff75b16d4f1aa660bb64424f41d5a09e8cebf482e8b99d55c9ad7ee3

    SHA512

    a4cac0a9a79e85f186e24b6cf498bc4c1444f234a05ffd52460a2f7e888cc82169ba05e7dad5a427fb40de29832898c8d216d34551394672afc961c5eccc08e1

  • /usr/bin/fwlwyqmwwj

    Filesize

    596KB

    MD5

    8337db6bfd6638aa1af88d36c56cd6ac

    SHA1

    7601df3d76e964bcdfed039984bfa6e80f569258

    SHA256

    ca9fbc0ec2bae1b9affb2f56ebb33913572a5c80570db3734ab46148f92dde1f

    SHA512

    d34419e9532e80b30ccab4a9661e94c0679d4dcd6feb3d00f3697963e789af76bc3f9108d53e0306a329dff69528c8d335997e0bd42c9e199f36389c9fe30610

  • /usr/bin/gmcdpoqavr

    Filesize

    596KB

    MD5

    99791fefe44ad9094c208da4f48a9e49

    SHA1

    b53b1018260d8f040a54f433a7a052b6595e6480

    SHA256

    59c26234c58feb14c75a71a008c7fbac1e0860265d9eb6bf9911ebd656ed18c0

    SHA512

    837a36390d1915e119336d1b46847c689aa2de393cc5502a495b2605913b5a775d29547085c1de2de796822515b74e8537dbb66a968812109b6d55324341701e

  • /usr/bin/gsnjvsionz

    Filesize

    596KB

    MD5

    2317ae38bd51bd433e3b4dc9a0d4e376

    SHA1

    32972371981e2bd8d25783a0330c77efc8c167fc

    SHA256

    a10b21028baa4672b1c37e16d5fedc2045544a9a433696e96ee4f1bb1e24052d

    SHA512

    193fad5fdffda6cdd1ad8219979d8bc7eb859b15de279a0eb08072a00bce237bae5921d7aab65e327133c57edb9ddbccb64b99637def2e0c5edd18fa6f8f293b

  • /usr/bin/hnmfdhnhxn

    Filesize

    596KB

    MD5

    5a4317ddf95bb628a5cbe4c99328fe31

    SHA1

    2dc19e10c76c629d4bb1fdac5fc11082a9557626

    SHA256

    efee164667e33da5a52da49e6bc5f594d2eac8482d69d77b20eae0fc2353fef8

    SHA512

    696869dd604e1d67e88fb0e2f386134e1b2e026f0d4280080456fe6db12262652dd732b8250148e482d3dca1b2716a2334582c10fb3d172478883da58cc62e9e

  • /usr/bin/hqenpdilsm

    Filesize

    596KB

    MD5

    ffdc23769853d12f584b75fa4b0a401b

    SHA1

    37dce194fa56b2b39f2c4a666db5697ed821eb6e

    SHA256

    939728b08c52366c02a5968c7936fba403467a5a91f880e972870ca164740b58

    SHA512

    ccf420b56d8c0ca33a31a9ddd7924cd6d7c591ca458253122326416ef5c71d0809be176d2c5c888172a742ca446ae6ce02d21d2d5af5197e388a6ec6461c8039

  • /usr/bin/hxojwbaszu

    Filesize

    596KB

    MD5

    f462858c27a5a2dbed7b83e5c960a530

    SHA1

    7bd81bde801bdab415b4e88236d85f1a1a121ab1

    SHA256

    0874aae0e3de197dbb1edff4f4465dfac0635d1aad6b4a43269f2c1600b2a848

    SHA512

    8eb8da53ecd8dc90d7916247b208cdd1c395bfde54ed3d24352e57978eb795a7217d625bb4255bfed82fed1752bdb202ea897e798f183378dc51a36570c7304e

  • /usr/bin/iabzbnkbrg

    Filesize

    596KB

    MD5

    e3b19193c57df4b775f788a55b51dddb

    SHA1

    7a29a495efe0f769c84d89d049256db58318b8b3

    SHA256

    b2012ab8e0043aabb424a11c578b57728f3ac972430bdbfc7996ff8bb0872628

    SHA512

    dc72a6663f4af13cf5bf3202b0af89cf9937042e9dcb459feff2bed782b20ed4d9c4736f51a38de31a8c2ba32f7a70dc92c887abd43c58f9e9e4ab970fff8647

  • /usr/bin/iamlmqfevi

    Filesize

    596KB

    MD5

    d49866ea25899c5c1dc97d28f7b2c303

    SHA1

    a5953a29f8741037feb9c7d834eb235702846e2d

    SHA256

    65e67861aabd633dd228dc8e3dfe6b9ecfea2dbe3689c85c5900a1f960ed23df

    SHA512

    7b820fd3c11e7554fb40d692dbcecd6c148ce04aa4241331c413ebb80b639ab75bcabe1db145d95c80abe2c0c3e904ba27745ec315bf389cd02bfbec6b0e5e60

  • /usr/bin/iojswztxds

    Filesize

    596KB

    MD5

    fdce2df25c1d8175365335cc70a04f4c

    SHA1

    6ddad4f203d8c476120691dac560c89c010aa77a

    SHA256

    8066b22b274270df702171751ddf8f51bff0be64840645bb3c39e945a4998f9c

    SHA512

    9f510666d90452e61b179579b76831570c611fb1a403f95ada791b1f784fd87e081013406e05c06d9c1092d2881caaff603e0905a4527740228c35c61186783b

  • /usr/bin/ixciigkzmg

    Filesize

    596KB

    MD5

    f8865279e99cd896563ac4da38e79fb7

    SHA1

    c9f162a8234763408e4671ffd240c9478ba118d6

    SHA256

    6c9b61ac4a177b3dcd52225abb1e95f8f7a7f19bb897fdf4719c3d9ba7ade432

    SHA512

    6dfd1532dc6b0134fc6be00d01d170c917a4b6215005423216bc66689068bcf4f21c026cab28d8fb11a3c2ca0d87f98a7b9d82435320c6054b17e9f621050384

  • /usr/bin/jtcpuzgiiz

    Filesize

    596KB

    MD5

    cc438c894a192d0780321ecc4569dbd1

    SHA1

    c4bdb21f633c26f4e014e98cdebfbb61114b257f

    SHA256

    cb2ebb427c762fe35b7ef637890f21c9466ade315a8755b15d1c6fa5f5f15a26

    SHA512

    10cea47b1bffefcd58f7b74d0cc9860443ff821b26b65d47aafc6da558e255dbf60f2da70e961d7608ec35e026fd4fe4988b6025dec3efb0d33ce791a385e945

  • /usr/bin/mokfemncgb

    Filesize

    596KB

    MD5

    ee883ede253430a0f234658be9a6fbb9

    SHA1

    8bdcaa4095e42dcfdff0ff35b48f50ede43cd63a

    SHA256

    b485fd878bcf0640ae44330066a7dabe95a95dd3897442801cc8c7f8969c4688

    SHA512

    3ca079edbf622d2a04b13144951c0549b49fc5bbbc4a4e121d6fa1c11580946fd8fca66efc936216a78ea39de14f5265e763f058e8d8f959bfe487d64c11a339

  • /usr/bin/mulcrwhehh

    Filesize

    596KB

    MD5

    516d921504e4a687b6c841b5f8ce7329

    SHA1

    2ffb74b65d6f2c3c3c0c266caf35f3de759a1ae3

    SHA256

    40bd6949b3281d9fba7120144eb41be15df9aa9932d311d095e0ca093d388f2b

    SHA512

    6050e2dfcb39e0d27ab41493ee518a39b873a4e4ad8590a53e6718a946d96f662d564dc6da83fe2a6ac492a72e6d8ec6816e7adaef4ce2a43019cfd5f61d1275

  • /usr/bin/opgjxscgcf

    Filesize

    596KB

    MD5

    1901af0f3cfb0a37cb646f7cdcf7481b

    SHA1

    b84422b33f5191c1548ebec0a646ed427bf4d61a

    SHA256

    1f793e0ccebc7d8b7319e657ec6f17a8c9b081b0a5bc8f71a060ec4a90dab5ed

    SHA512

    306d7a64d513f8a4b3f70f6616d2de59247c85b1aa35687bebfc1c11e55824df9b1621c73b95811912e90a85e9ec94f2dbee346a6232a65c39d61387bac35ee3

  • /usr/bin/pekqwyxdwa

    Filesize

    596KB

    MD5

    b300de38be4161ddbe16cf5657fb7697

    SHA1

    7d7c44690be98e5ac959dbc9556ed4a58819a7a6

    SHA256

    316fb87a5a57db4c08b0ea2f253822cd60656fd881770c24eb4054293008eb38

    SHA512

    1e05b7b29d7c7930565722bfb1eb8988e517ae9d00c2a2158fb28b7f855a8c82c9b73413fb44b46ccd629735581b3daf551225b54330ffb520f1fbb8bdfc0f4e

  • /usr/bin/pfkkgbipbv

    Filesize

    596KB

    MD5

    326c6626b3ad167e23e3179c98bf14b6

    SHA1

    fb3cf39a33abc01655a4e20635e2666db54e6649

    SHA256

    bc43a3d5e948fa18b8009896341eb864763c58a4e220b0333ac71e53afd26932

    SHA512

    81d3dfc4890706e0b998e3301b6218395733be6608ee2c2c8698b1ca4082603558a75cab644a9cefdd50e4d8f22ffedd9e3086f233339f755848e7c579ce2a0d

  • /usr/bin/poroucghrm

    Filesize

    596KB

    MD5

    6fce7e259dcce00059f70a087926f179

    SHA1

    29b8eb010956d6410c6ae06e3ae15c3fa5fa40e3

    SHA256

    cdf1e1c99301c62f1bef24d8aa5dd1f73aa25597be7bc0f45a0906cc4342a01d

    SHA512

    fcc221fad916957a5090e07fcdd38a15787a6b0ff69feeb26831f54a1f1724ec08594224eb42497570900a48ed7fed0051db0ebc95a54c3b24ae198f9b0bd6bb

  • /usr/bin/qnqpefgrac

    Filesize

    596KB

    MD5

    ea9a083c96fd9a15a5043bf610326573

    SHA1

    7dd4c48e375c25fcb82a7a58a8d23951e92cf84f

    SHA256

    1ca775da726bd904a6560f5be14363ceb15c63752cc88dca2d0b762fdf51cca0

    SHA512

    dc409750640a62e3a15d90659ecc2d0ba6054e3c9c6d15c817f1f9b2c4f369f9ea479dec3a3549156270654a1230d32daebfb535b297b59636c246f13f52fb22

  • /usr/bin/reqxwcaxty

    Filesize

    596KB

    MD5

    56e9d687fa1758d5022a7f3d7b9b7d2d

    SHA1

    cf092371cce68248339e45df2594ee68b30402cf

    SHA256

    e7edc2df21e78a64d06c0b3c22a11a9b020309e7d6449f7cab96fd518f656640

    SHA512

    52c7c3f8d4bfed24cf35e012096c4c20976a8f3b56906e0b094fd32bc6bcb4eca921025da52bfcf6f23c48659d3f716e550ebf86d1a42d81fdb7010c7f5a05e3

  • /usr/bin/smrfxwsajb

    Filesize

    596KB

    MD5

    c72daf70f15a4d1ffde7c1de6d2e5cb0

    SHA1

    d0cf767c866721b5162bfbfed7eb651347b2a67c

    SHA256

    26ce0ed3b0f8315da5a53c4d6bf982950e21262ba7ba124cd0714bf888b8b1bf

    SHA512

    c6f04722e7ea2f323bd2f5b3c3450c09977e1f4d9abab28fd88c65bc6ae8c6eb1d2a5234a18d74598735dce937c457f1b8cf9c2d9621108ecfaba9f7adebccc3

  • /usr/bin/vajqcriuqq

    Filesize

    596KB

    MD5

    ff5ba05ee0f8006532194f4431782044

    SHA1

    95ec6216709cbcfe5f2a4c5668e7b2021a5dfa60

    SHA256

    23efdc3f14fa2d674c53af911b66fdab80352d8488a36fbe3f740428a267338a

    SHA512

    6ff3e29b7e63ff6facbf2bb21742e4a9b9acf2ae2942e25d2747a8c00a2d03eaaaa74df713225033c28a803a5de5600a52b24a1f9349bfefe3afb8aafaf45781

  • /usr/bin/wqzhvehogx

    Filesize

    596KB

    MD5

    c902d62986e4a1a41d65a7ea1c5aab11

    SHA1

    7f1c707198786d612870be1a12d56acdceaae1e5

    SHA256

    0b4f441aaeb8f1311891e780b1e712df1766852d74e092b1855622a55335e3fa

    SHA512

    8e4e0d1a4ddedc4999cb2e557f732fc4f1b5a449ff55ec81f8176a8276ca3679388230f896447fd03587095b4d08b5c0fde4d828d99fed58207b3330172af020

  • /usr/bin/xhpqwrffok

    Filesize

    596KB

    MD5

    f44df37312657bac33e1cc11842e1a5b

    SHA1

    0f52e19b026ba9e9c96ef72af76c43a8bf1f1d26

    SHA256

    e19cb9a4b8d657c14febb309fd5474f3f6eae724b0fef26a676b90b4210f590b

    SHA512

    29073bedff2ffcb068edd0ce4cc77b559658b5e47a4eb777d20b47ce4b2b0a63f7efc6ea74dce54a52464079936d27aeaccc02c88768340feafcbee5325fdd74

  • /usr/bin/zuxqtkturj

    Filesize

    596KB

    MD5

    c737d47ccc4c416c6605536f9d1cdfb9

    SHA1

    ce6d42c9a90f649596a8fe9381f80e133af303b5

    SHA256

    ef23d1601f54a0712ab683a818faf5fc965c5bc68c775dfec526ebea84c3e9e1

    SHA512

    6e07cdadb93b5ed838262f0329c6822a384679c800ec61fd32c4856424efd7d095f291bd8c66593d654775a2418d86a5df80df25410df92624bccf41d068d9b6

  • /usr/lib/libudev4.so

    Filesize

    596KB

    MD5

    d24e975bd11c5e17ce8fa6a5b8ab52ca

    SHA1

    e83557dce06c238a6c2d04ec7da00d908c90c82e

    SHA256

    a52428f16f891e1a17375cbee34fdb68c83632988e7b1ae1590bacda2724cc0b

    SHA512

    16cb95f72708869d75c9e4f63d1cb5fa95ccddb9460fc6a4bc8c3837e46df512a8e4e87bf24e7e9ae9b44357536694fa96308a1436cdb7e6ac1609f192f3dc60