Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
07-09-2024 15:58
Behavioral task
behavioral1
Sample
d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118
-
Size
596KB
-
MD5
d24e975bd11c5e17ce8fa6a5b8ab52ca
-
SHA1
e83557dce06c238a6c2d04ec7da00d908c90c82e
-
SHA256
a52428f16f891e1a17375cbee34fdb68c83632988e7b1ae1590bacda2724cc0b
-
SHA512
16cb95f72708869d75c9e4f63d1cb5fa95ccddb9460fc6a4bc8c3837e46df512a8e4e87bf24e7e9ae9b44357536694fa96308a1436cdb7e6ac1609f192f3dc60
-
SSDEEP
12288:rPTJS+naeW9kclFEcMWbHdxZ7GkR2fo/6y9P/YAh7Dxu9hc7L:DTJfrW99q4bHdxZ7G1foFND4XcP
Malware Config
Extracted
xorddos
http://full.dsaj2a.org/b/u.php
gh.dsaj2a1.org:2415
pengpenga.xicp.net:2415
61.174.49.203:2415
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
Processes:
resource yara_rule /usr/lib/libudev4.so family_xorddos /usr/bin/qnqpefgrac family_xorddos /usr/bin/bvvafwqxxr family_xorddos /usr/bin/fbhruzpqtr family_xorddos /usr/bin/smrfxwsajb family_xorddos /usr/bin/zuxqtkturj family_xorddos /usr/bin/fwlwyqmwwj family_xorddos /usr/bin/wqzhvehogx family_xorddos /usr/bin/gsnjvsionz family_xorddos /usr/bin/iamlmqfevi family_xorddos /usr/bin/ixciigkzmg family_xorddos /usr/bin/elnwveeatx family_xorddos /usr/bin/hnmfdhnhxn family_xorddos /usr/bin/mulcrwhehh family_xorddos /usr/bin/vajqcriuqq family_xorddos /usr/bin/gmcdpoqavr family_xorddos /usr/bin/iabzbnkbrg family_xorddos /usr/bin/reqxwcaxty family_xorddos /usr/bin/mokfemncgb family_xorddos /usr/bin/pfkkgbipbv family_xorddos /usr/bin/bsyjpdzvon family_xorddos /usr/bin/hxojwbaszu family_xorddos /usr/bin/jtcpuzgiiz family_xorddos /usr/bin/dwtnkwuwdj family_xorddos /usr/bin/poroucghrm family_xorddos /usr/bin/hqenpdilsm family_xorddos /usr/bin/eyxsqodplz family_xorddos /usr/bin/pekqwyxdwa family_xorddos /usr/bin/iojswztxds family_xorddos /usr/bin/opgjxscgcf family_xorddos /usr/bin/xhpqwrffok family_xorddos -
Writes memory of remote process 2 IoCs
Processes:
d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118pid process 2527 d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118 2536 -
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
Processes:
d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118pid process 2527 d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118 2528 2533 2528 2537 2536 2538 2540 2528 2542 2550 2544 2547 2552 2554 2549 2561 2562 2536 2536 2528 2528 2550 2550 2552 2552 2554 2554 2561 2561 2562 2562 2536 2536 2550 2550 2552 2552 2554 2554 2561 2561 2562 2562 2536 2536 2550 2550 2552 2552 2554 2554 2561 2561 2562 2562 2536 2536 2550 2550 2552 2552 2554 2554 -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 Destination IP 103.25.9.228 -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118description ioc process File opened for modification /etc/crontab d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118 -
Processes:
sedsystemctldescription ioc process File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems systemctl
Processes
-
/tmp/d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118/tmp/d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes1181⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
PID:2527 -
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc4.sh/d" /etc/crontab2⤵
- Reads runtime system information
PID:2535
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
PID:2545
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD54bc702c21d7b2bbb32638e37ec6c3943
SHA16b097d447b57c10f10f67ccd5efac4e4d39ddd38
SHA256f702b3fd1837f30a23c74d5605e0c9cf79a480b942ef7d3bb9f79d448101a8b3
SHA51219523b3e006eaa41a22a6af5ad1d0b23adf7eb5c653e367229b2d6bf69066a7630d637ae4131e5ae98e63434b00f6af5bef4ece54d7ad66d5c92b8f549f5b3f8
-
Filesize
1KB
MD5d7bd8be873656590bcd306cb9560d50a
SHA1cf3dc20140d87c4e1618174601ccb0c8e4c11aca
SHA2563b2b5851a245091f7c26f611b476d72052f838a1078a3f7dd38f679a33b64457
SHA5120e477701b43ffc8068b0ffc95ef105cdc09e6c856af4535287617e0e27f933d7f3cdbb9b6d95d156a05e554e37f734b40c72c2d709892838a7e8f95b5fe3b208
-
Filesize
495B
MD573afe9cc3ba857a905cfdd1b3f6f9690
SHA10b34cb28bd1a5549e41dafc8a01885f53bdc55d2
SHA256c2213360f5507d64f8e7d28d9ec0662b229aeed5f8c082b1b097db7caf6ffbca
SHA512281f43d4419e72e3298c229be80b9f605d6cc9ade32b554e82647a24478d5a0131512df3544c0b6d60b30c2fbe81e2951fb0b491fa51530171781bfd6fa27aeb
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD51c8a3dff2135abf2d84ba8a5d8711e84
SHA1ebc4632ded90b635ab209cbecaf81d5f7fe5deaa
SHA25687ed6be419a6efc047a3285d779080b301b17f35c9d48d888e70fd80ac473baa
SHA512cf7e5eef7ef12e0b2f65b1fed82eeddd0cb524b5863698a5c1cb623ee0b7295e569768f72620e66579af1766d8d6afba6cc6510eaee239e191aa5f534045d13d
-
Filesize
596KB
MD542f8814285b32893b1125b0ac8e97427
SHA150b3fa90c6666454cd68b204bfcf67501d4fd842
SHA256acddb74be0a722d8eefc9e67752edbac0366aa370859dffa710a8c5fea489b46
SHA5128d9062acf2ade5ac087e192294963cb4674be6d9c2eb6700582569c9d1632190bca278f733b0530a60d8be6ff9421f0cfe9b95520ac6ca1370dc291351703f6b
-
Filesize
596KB
MD5120c69fdbca40ef762f53cb127797dcb
SHA1fd8354c5eba0f88bb664167c893c74e8d0021ec9
SHA256f1a1d63906a369226021d8848a62556dc22d54ea25c9c57ae0420fc0aa30b367
SHA512e72135cda99611a6e4f38a311aa428303a71a36e0d8ce7f6ec280a2e4e51dde803414a5884e59b8fda6d2c2d186c0fe9e10c4ef32256a12209cc5237e13e5cd5
-
Filesize
596KB
MD5a77a3745bda4b930bd5131e8b7bea2e5
SHA1ca2ce67ea3e49c658c173ce3d62f1ea50cd1cea6
SHA256d67e083339297d8768bc1d38273265e22f60b9e89d9b7d53814fdd1d2678d8b4
SHA512817a93534532efc442c693bd91d215783e52b2c0ee85b7fd4d06be983a11d718322c86e268f84873e805d023c8f13a2916e91fb67fb77243b5259ce88d21856b
-
Filesize
596KB
MD565a4ca66bbd038d4dc05dc11835a4443
SHA1513323da3a819d616f1156ec82d14e64294e1880
SHA2568c92f651a08727656e3a33dd30ff7835ec447a5cacc81436375b2d0554d4a18f
SHA512af00c227ca6e652469286ec77923a283c15d2ea3fdd57355e038fea4383d51ad4ba5c89305e3bdb7cdd5b6f7be64189941ccfe022aa0f69d71a76eba80341602
-
Filesize
596KB
MD5bc74d7745d31f1b376f5cd1a11e925fc
SHA188f283bde70e346ca56619087f1b1eba68388a74
SHA256fc0134be8674759d970746fe55b29c7ed78cb1c48a0c48ab72e55b599ba63333
SHA512af5db10c8e8f34165a4180b6069d945ffad73d8dee7278b51beff0620e156aaaf2f83900828e54e73d02e1089d2fd1f77a83f444271ab1b3ac6140d0b75dd1c2
-
Filesize
596KB
MD50a58c4714eb7966a01af7ae5a58df384
SHA11f39e6c22cc84dc7c5cd6273f58012c1c0991da3
SHA256136352aeff75b16d4f1aa660bb64424f41d5a09e8cebf482e8b99d55c9ad7ee3
SHA512a4cac0a9a79e85f186e24b6cf498bc4c1444f234a05ffd52460a2f7e888cc82169ba05e7dad5a427fb40de29832898c8d216d34551394672afc961c5eccc08e1
-
Filesize
596KB
MD58337db6bfd6638aa1af88d36c56cd6ac
SHA17601df3d76e964bcdfed039984bfa6e80f569258
SHA256ca9fbc0ec2bae1b9affb2f56ebb33913572a5c80570db3734ab46148f92dde1f
SHA512d34419e9532e80b30ccab4a9661e94c0679d4dcd6feb3d00f3697963e789af76bc3f9108d53e0306a329dff69528c8d335997e0bd42c9e199f36389c9fe30610
-
Filesize
596KB
MD599791fefe44ad9094c208da4f48a9e49
SHA1b53b1018260d8f040a54f433a7a052b6595e6480
SHA25659c26234c58feb14c75a71a008c7fbac1e0860265d9eb6bf9911ebd656ed18c0
SHA512837a36390d1915e119336d1b46847c689aa2de393cc5502a495b2605913b5a775d29547085c1de2de796822515b74e8537dbb66a968812109b6d55324341701e
-
Filesize
596KB
MD52317ae38bd51bd433e3b4dc9a0d4e376
SHA132972371981e2bd8d25783a0330c77efc8c167fc
SHA256a10b21028baa4672b1c37e16d5fedc2045544a9a433696e96ee4f1bb1e24052d
SHA512193fad5fdffda6cdd1ad8219979d8bc7eb859b15de279a0eb08072a00bce237bae5921d7aab65e327133c57edb9ddbccb64b99637def2e0c5edd18fa6f8f293b
-
Filesize
596KB
MD55a4317ddf95bb628a5cbe4c99328fe31
SHA12dc19e10c76c629d4bb1fdac5fc11082a9557626
SHA256efee164667e33da5a52da49e6bc5f594d2eac8482d69d77b20eae0fc2353fef8
SHA512696869dd604e1d67e88fb0e2f386134e1b2e026f0d4280080456fe6db12262652dd732b8250148e482d3dca1b2716a2334582c10fb3d172478883da58cc62e9e
-
Filesize
596KB
MD5ffdc23769853d12f584b75fa4b0a401b
SHA137dce194fa56b2b39f2c4a666db5697ed821eb6e
SHA256939728b08c52366c02a5968c7936fba403467a5a91f880e972870ca164740b58
SHA512ccf420b56d8c0ca33a31a9ddd7924cd6d7c591ca458253122326416ef5c71d0809be176d2c5c888172a742ca446ae6ce02d21d2d5af5197e388a6ec6461c8039
-
Filesize
596KB
MD5f462858c27a5a2dbed7b83e5c960a530
SHA17bd81bde801bdab415b4e88236d85f1a1a121ab1
SHA2560874aae0e3de197dbb1edff4f4465dfac0635d1aad6b4a43269f2c1600b2a848
SHA5128eb8da53ecd8dc90d7916247b208cdd1c395bfde54ed3d24352e57978eb795a7217d625bb4255bfed82fed1752bdb202ea897e798f183378dc51a36570c7304e
-
Filesize
596KB
MD5e3b19193c57df4b775f788a55b51dddb
SHA17a29a495efe0f769c84d89d049256db58318b8b3
SHA256b2012ab8e0043aabb424a11c578b57728f3ac972430bdbfc7996ff8bb0872628
SHA512dc72a6663f4af13cf5bf3202b0af89cf9937042e9dcb459feff2bed782b20ed4d9c4736f51a38de31a8c2ba32f7a70dc92c887abd43c58f9e9e4ab970fff8647
-
Filesize
596KB
MD5d49866ea25899c5c1dc97d28f7b2c303
SHA1a5953a29f8741037feb9c7d834eb235702846e2d
SHA25665e67861aabd633dd228dc8e3dfe6b9ecfea2dbe3689c85c5900a1f960ed23df
SHA5127b820fd3c11e7554fb40d692dbcecd6c148ce04aa4241331c413ebb80b639ab75bcabe1db145d95c80abe2c0c3e904ba27745ec315bf389cd02bfbec6b0e5e60
-
Filesize
596KB
MD5fdce2df25c1d8175365335cc70a04f4c
SHA16ddad4f203d8c476120691dac560c89c010aa77a
SHA2568066b22b274270df702171751ddf8f51bff0be64840645bb3c39e945a4998f9c
SHA5129f510666d90452e61b179579b76831570c611fb1a403f95ada791b1f784fd87e081013406e05c06d9c1092d2881caaff603e0905a4527740228c35c61186783b
-
Filesize
596KB
MD5f8865279e99cd896563ac4da38e79fb7
SHA1c9f162a8234763408e4671ffd240c9478ba118d6
SHA2566c9b61ac4a177b3dcd52225abb1e95f8f7a7f19bb897fdf4719c3d9ba7ade432
SHA5126dfd1532dc6b0134fc6be00d01d170c917a4b6215005423216bc66689068bcf4f21c026cab28d8fb11a3c2ca0d87f98a7b9d82435320c6054b17e9f621050384
-
Filesize
596KB
MD5cc438c894a192d0780321ecc4569dbd1
SHA1c4bdb21f633c26f4e014e98cdebfbb61114b257f
SHA256cb2ebb427c762fe35b7ef637890f21c9466ade315a8755b15d1c6fa5f5f15a26
SHA51210cea47b1bffefcd58f7b74d0cc9860443ff821b26b65d47aafc6da558e255dbf60f2da70e961d7608ec35e026fd4fe4988b6025dec3efb0d33ce791a385e945
-
Filesize
596KB
MD5ee883ede253430a0f234658be9a6fbb9
SHA18bdcaa4095e42dcfdff0ff35b48f50ede43cd63a
SHA256b485fd878bcf0640ae44330066a7dabe95a95dd3897442801cc8c7f8969c4688
SHA5123ca079edbf622d2a04b13144951c0549b49fc5bbbc4a4e121d6fa1c11580946fd8fca66efc936216a78ea39de14f5265e763f058e8d8f959bfe487d64c11a339
-
Filesize
596KB
MD5516d921504e4a687b6c841b5f8ce7329
SHA12ffb74b65d6f2c3c3c0c266caf35f3de759a1ae3
SHA25640bd6949b3281d9fba7120144eb41be15df9aa9932d311d095e0ca093d388f2b
SHA5126050e2dfcb39e0d27ab41493ee518a39b873a4e4ad8590a53e6718a946d96f662d564dc6da83fe2a6ac492a72e6d8ec6816e7adaef4ce2a43019cfd5f61d1275
-
Filesize
596KB
MD51901af0f3cfb0a37cb646f7cdcf7481b
SHA1b84422b33f5191c1548ebec0a646ed427bf4d61a
SHA2561f793e0ccebc7d8b7319e657ec6f17a8c9b081b0a5bc8f71a060ec4a90dab5ed
SHA512306d7a64d513f8a4b3f70f6616d2de59247c85b1aa35687bebfc1c11e55824df9b1621c73b95811912e90a85e9ec94f2dbee346a6232a65c39d61387bac35ee3
-
Filesize
596KB
MD5b300de38be4161ddbe16cf5657fb7697
SHA17d7c44690be98e5ac959dbc9556ed4a58819a7a6
SHA256316fb87a5a57db4c08b0ea2f253822cd60656fd881770c24eb4054293008eb38
SHA5121e05b7b29d7c7930565722bfb1eb8988e517ae9d00c2a2158fb28b7f855a8c82c9b73413fb44b46ccd629735581b3daf551225b54330ffb520f1fbb8bdfc0f4e
-
Filesize
596KB
MD5326c6626b3ad167e23e3179c98bf14b6
SHA1fb3cf39a33abc01655a4e20635e2666db54e6649
SHA256bc43a3d5e948fa18b8009896341eb864763c58a4e220b0333ac71e53afd26932
SHA51281d3dfc4890706e0b998e3301b6218395733be6608ee2c2c8698b1ca4082603558a75cab644a9cefdd50e4d8f22ffedd9e3086f233339f755848e7c579ce2a0d
-
Filesize
596KB
MD56fce7e259dcce00059f70a087926f179
SHA129b8eb010956d6410c6ae06e3ae15c3fa5fa40e3
SHA256cdf1e1c99301c62f1bef24d8aa5dd1f73aa25597be7bc0f45a0906cc4342a01d
SHA512fcc221fad916957a5090e07fcdd38a15787a6b0ff69feeb26831f54a1f1724ec08594224eb42497570900a48ed7fed0051db0ebc95a54c3b24ae198f9b0bd6bb
-
Filesize
596KB
MD5ea9a083c96fd9a15a5043bf610326573
SHA17dd4c48e375c25fcb82a7a58a8d23951e92cf84f
SHA2561ca775da726bd904a6560f5be14363ceb15c63752cc88dca2d0b762fdf51cca0
SHA512dc409750640a62e3a15d90659ecc2d0ba6054e3c9c6d15c817f1f9b2c4f369f9ea479dec3a3549156270654a1230d32daebfb535b297b59636c246f13f52fb22
-
Filesize
596KB
MD556e9d687fa1758d5022a7f3d7b9b7d2d
SHA1cf092371cce68248339e45df2594ee68b30402cf
SHA256e7edc2df21e78a64d06c0b3c22a11a9b020309e7d6449f7cab96fd518f656640
SHA51252c7c3f8d4bfed24cf35e012096c4c20976a8f3b56906e0b094fd32bc6bcb4eca921025da52bfcf6f23c48659d3f716e550ebf86d1a42d81fdb7010c7f5a05e3
-
Filesize
596KB
MD5c72daf70f15a4d1ffde7c1de6d2e5cb0
SHA1d0cf767c866721b5162bfbfed7eb651347b2a67c
SHA25626ce0ed3b0f8315da5a53c4d6bf982950e21262ba7ba124cd0714bf888b8b1bf
SHA512c6f04722e7ea2f323bd2f5b3c3450c09977e1f4d9abab28fd88c65bc6ae8c6eb1d2a5234a18d74598735dce937c457f1b8cf9c2d9621108ecfaba9f7adebccc3
-
Filesize
596KB
MD5ff5ba05ee0f8006532194f4431782044
SHA195ec6216709cbcfe5f2a4c5668e7b2021a5dfa60
SHA25623efdc3f14fa2d674c53af911b66fdab80352d8488a36fbe3f740428a267338a
SHA5126ff3e29b7e63ff6facbf2bb21742e4a9b9acf2ae2942e25d2747a8c00a2d03eaaaa74df713225033c28a803a5de5600a52b24a1f9349bfefe3afb8aafaf45781
-
Filesize
596KB
MD5c902d62986e4a1a41d65a7ea1c5aab11
SHA17f1c707198786d612870be1a12d56acdceaae1e5
SHA2560b4f441aaeb8f1311891e780b1e712df1766852d74e092b1855622a55335e3fa
SHA5128e4e0d1a4ddedc4999cb2e557f732fc4f1b5a449ff55ec81f8176a8276ca3679388230f896447fd03587095b4d08b5c0fde4d828d99fed58207b3330172af020
-
Filesize
596KB
MD5f44df37312657bac33e1cc11842e1a5b
SHA10f52e19b026ba9e9c96ef72af76c43a8bf1f1d26
SHA256e19cb9a4b8d657c14febb309fd5474f3f6eae724b0fef26a676b90b4210f590b
SHA51229073bedff2ffcb068edd0ce4cc77b559658b5e47a4eb777d20b47ce4b2b0a63f7efc6ea74dce54a52464079936d27aeaccc02c88768340feafcbee5325fdd74
-
Filesize
596KB
MD5c737d47ccc4c416c6605536f9d1cdfb9
SHA1ce6d42c9a90f649596a8fe9381f80e133af303b5
SHA256ef23d1601f54a0712ab683a818faf5fc965c5bc68c775dfec526ebea84c3e9e1
SHA5126e07cdadb93b5ed838262f0329c6822a384679c800ec61fd32c4856424efd7d095f291bd8c66593d654775a2418d86a5df80df25410df92624bccf41d068d9b6
-
Filesize
596KB
MD5d24e975bd11c5e17ce8fa6a5b8ab52ca
SHA1e83557dce06c238a6c2d04ec7da00d908c90c82e
SHA256a52428f16f891e1a17375cbee34fdb68c83632988e7b1ae1590bacda2724cc0b
SHA51216cb95f72708869d75c9e4f63d1cb5fa95ccddb9460fc6a4bc8c3837e46df512a8e4e87bf24e7e9ae9b44357536694fa96308a1436cdb7e6ac1609f192f3dc60