Extracted

• • Target

    01942bbe326395e8bf8312c304b30c21_JaffaCakes118

  • Size

    247KB

  • MD5

    01942bbe326395e8bf8312c304b30c21

  • SHA1

    b8a481e91c77631aa74b8188b17166d9861dfde0

  • SHA256

    9c7e43e5212142a195a794486b13efcc9779f9c0742b608c66c18937856bb452

  • SHA512

    914224281378d60adca99c34848485550c1eb29f95a6755d83d10d9a55ea21fb6e973fc5bb144a20b3ebd25b8a8cdc8b5aa819aa2f345c3dada5d39d9c2d1b7b

  • SSDEEP

    6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCPhhhR//mqYi:mZRgUY/fsJcO1KOiXOhhhBei

  Score

  10^/10

  xorddosbotnetdownloaderinfostealerpersistenceupx

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1