Analysis
-
max time kernel
10s -
max time network
9s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
06-12-2024 09:10
Behavioral task
behavioral1
Sample
caeeadeea0762565473ac39681101c29_JaffaCakes118
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
caeeadeea0762565473ac39681101c29_JaffaCakes118
-
Size
611KB
-
MD5
caeeadeea0762565473ac39681101c29
-
SHA1
1f7aad5e0e5996ed5c6634d08066df13b7e01440
-
SHA256
94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
-
SHA512
3c0a150894fc8a84a2b4ccaaa935fcfc74f07b16626f1ca82b34f743d5ee77bae2e4143b132721648275c4c3e7e5ac27687da16d25607d7ff3cab3ad1b1d74a4
-
SSDEEP
12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNIBVEBl/91h
Malware Config
Extracted
xorddos
http://aaa.dsaj2a.org/config.rar
ww.dnstells.com:53
ww.gzcfr5axf6.com:53
ww.gzcfr5axf7.com:53
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 4 IoCs
resource yara_rule behavioral1/files/fstream-6.dat family_xorddos behavioral1/files/fstream-7.dat family_xorddos behavioral1/files/fstream-8.dat family_xorddos behavioral1/files/fstream-9.dat family_xorddos -
Xorddos family
-
Writes memory of remote process 2 IoCs
pid Process 4068 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 -
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
pid Process 4068 caeeadeea0762565473ac39681101c29_JaffaCakes118 4069 caeeadeea0762565473ac39681101c29_JaffaCakes118 4075 caeeadeea0762565473ac39681101c29_JaffaCakes118 4069 caeeadeea0762565473ac39681101c29_JaffaCakes118 4078 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4069 caeeadeea0762565473ac39681101c29_JaffaCakes118 4083 caeeadeea0762565473ac39681101c29_JaffaCakes118 4081 caeeadeea0762565473ac39681101c29_JaffaCakes118 4085 caeeadeea0762565473ac39681101c29_JaffaCakes118 4087 caeeadeea0762565473ac39681101c29_JaffaCakes118 4089 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4069 caeeadeea0762565473ac39681101c29_JaffaCakes118 4069 caeeadeea0762565473ac39681101c29_JaffaCakes118 4078 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4078 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4097 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4104 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4077 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4094 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4095 caeeadeea0762565473ac39681101c29_JaffaCakes118 4096 caeeadeea0762565473ac39681101c29_JaffaCakes118 -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 103.254.75.120 -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/crontab caeeadeea0762565473ac39681101c29_JaffaCakes118 -
description ioc Process File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems systemctl
Processes
-
/tmp/caeeadeea0762565473ac39681101c29_JaffaCakes118/tmp/caeeadeea0762565473ac39681101c29_JaffaCakes1181⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
PID:4068 -
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
PID:4076
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
PID:4091
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
495B
MD55a1815a39c495ac397e0b698831c8b87
SHA1a241152f39226030b2d3621b141e7a7bc218f129
SHA25652c827d5f2bd57439eac7bcf4d0fe55c0d34239c87160e2bf4de90f77ccc3792
SHA512f4439d9ed40cb2cac7599914bcb592862097e84c8397d66663e527d3338418d5abd44061ba0d25f91650db277107a9a2dcc1315ac8f5c26df555b7e24ff056ed
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD546ad5826153d127109a0a69aaca3cd72
SHA17a628d1a6b9f5f5bac654ffa983ef188722c736e
SHA2567fb41b4a1085b29d9c7001184e7b398e68f0251e7a26f59f3ca1f0ad1abace3e
SHA512dd05f7783deb11f579e47f13ce1221b830ec05dcc9fba3fb3cb94829713ecc10fffa6ce58c5ee6bfcbe00ea0c0e21d26f5cb4951b175377ba60e31c09d3da4e7
-
Filesize
611KB
MD5b97e725f502520a2cec86e6f54d20629
SHA187d1844242fb6c4665fccab19b40f782be981bcb
SHA25644d0ac900d9e148ed9429c616febbaa49e760975ef5a35eb8ae0d5ee9dd0094b
SHA512915cfd481da96dc857682fe57078d716f47a20524d58db5117c1c891f86c59303af0f8001647ac0033c5d17b9aa9aee36f17f3ffd28e572292a6ff00beb8429e
-
Filesize
611KB
MD5eba18f3a557757640cb11d2b74294655
SHA10ac70c198bcf3facee2894b82e99bea004953ffe
SHA2564032e253b0ab8d8b6714956235f6230f2852dfa09d17eea3e0367f4f66988d12
SHA51236c6b5d8e7394a189151d5e7c22d3407ffb82158e5c68b8223885a56cc9802db824ab6464f600e521cc14331f75aa804315c4608a5dd842c6c6404a0dcb14a24
-
Filesize
302KB
MD5fef1a8c8d14c7a283b0fea45073c3650
SHA1385b3b4a355e172092a22499bb5fa02e8e8d5092
SHA25695104713eb4718f9490e2fdab4c9f27e3f1309dad7625e49364e2868854d5999
SHA512a88ad514587d8126437f54af12f11bc280c932e1b0785fb54d89930ca2c45a09d06c30283f8eec4b1b0604c7aaa42a2ba1c58a9f2edc2fdedc8d6183d6a6975e
-
Filesize
611KB
MD5caeeadeea0762565473ac39681101c29
SHA11f7aad5e0e5996ed5c6634d08066df13b7e01440
SHA25694b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f
SHA5123c0a150894fc8a84a2b4ccaaa935fcfc74f07b16626f1ca82b34f743d5ee77bae2e4143b132721648275c4c3e7e5ac27687da16d25607d7ff3cab3ad1b1d74a4