General

  • Target

    09489b80975a6f1a076784f0838c91b5_JaffaCakes118

  • Size

    611KB

  • Sample

    241002-g228ps1eml

  • MD5

    09489b80975a6f1a076784f0838c91b5

  • SHA1

    a71ebc35aadce35194841607d314c83edd7afa27

  • SHA256

    32db4c85faf0d58065912af97522befafcfdf73e92a3d549ea11921d25cc6547

  • SHA512

    2d42430a5af31d99bb8f38dc456a8ae4f34516a1e20529d0aac6a1cf14cea1270611a3a7c1c2cc0696ea9a04b7167a70e6c6f242cd6086e01c5fd0a2fee77304

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrkT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNkBVEBl/91h

Malware Config

Extracted

Family

xorddos

C2

http://aaa.dsaj2a.org/config.rar

ww.dnstells.com:3306

ww.gzcfr5axf6.com:3306

ww.gzcfr5axf7.com:3306

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target

      09489b80975a6f1a076784f0838c91b5_JaffaCakes118

    • Size

      611KB

    • MD5

      09489b80975a6f1a076784f0838c91b5

    • SHA1

      a71ebc35aadce35194841607d314c83edd7afa27

    • SHA256

      32db4c85faf0d58065912af97522befafcfdf73e92a3d549ea11921d25cc6547

    • SHA512

      2d42430a5af31d99bb8f38dc456a8ae4f34516a1e20529d0aac6a1cf14cea1270611a3a7c1c2cc0696ea9a04b7167a70e6c6f242cd6086e01c5fd0a2fee77304

    • SSDEEP

      12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrkT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNkBVEBl/91h

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    • XorDDoS payload

    • Writes memory of remote process

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

MITRE ATT&CK Enterprise v15

Tasks