General

  • Target

    e555d685a5162bcef0f59a34a68ef819_JaffaCakes118

  • Size

    610KB

  • Sample

    240916-wr42wasbqh

  • MD5

    e555d685a5162bcef0f59a34a68ef819

  • SHA1

    3ac8465d231841b93aeb4caeee56490c7e4748b8

  • SHA256

    af4323d7f8b4626eaa5e110a3bfb59f1dd2b555cd7a5b801b667af80e306ff74

  • SHA512

    ee9401e7341f5b2d14298b8332c03b9404535c0c3e2eb6286dd77bf01645334fb0765e16b49b0513b3983e727328200da29b33f64d175056ea7e331d2899f471

  • SSDEEP

    12288:WBmHsnhar0nJ7FGY5HRYxC1mqiL40qFCWU7k/3U6yZNnXgW4UlUuTh1AG:WBmHgaUVFGAR11mTL40q/5GpXgUl/91h

Malware Config

Extracted

Family

xorddos

C2

http://www1.gggatat456.com/dd.rar

ppp.gggatat456.com:1522

ppp.xxxatat456.com:1522

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target

      e555d685a5162bcef0f59a34a68ef819_JaffaCakes118

    • Size

      610KB

    • MD5

      e555d685a5162bcef0f59a34a68ef819

    • SHA1

      3ac8465d231841b93aeb4caeee56490c7e4748b8

    • SHA256

      af4323d7f8b4626eaa5e110a3bfb59f1dd2b555cd7a5b801b667af80e306ff74

    • SHA512

      ee9401e7341f5b2d14298b8332c03b9404535c0c3e2eb6286dd77bf01645334fb0765e16b49b0513b3983e727328200da29b33f64d175056ea7e331d2899f471

    • SSDEEP

      12288:WBmHsnhar0nJ7FGY5HRYxC1mqiL40qFCWU7k/3U6yZNnXgW4UlUuTh1AG:WBmHgaUVFGAR11mTL40q/5GpXgUl/91h

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    • XorDDoS payload

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Write file to user bin folder

MITRE ATT&CK Enterprise v15

Tasks