Extracted

• • Target

    3b614f5f8145fa12d8ab1adaf46dd252_JaffaCakes118

  • Size

    647KB

  • MD5

    3b614f5f8145fa12d8ab1adaf46dd252

  • SHA1

    cca3b65a7f388f74b34d149b90c73411783a2e4e

  • SHA256

    ed03a03a98f1b157c0b2eda15f9669f3e2f24262d329313542d9a4e6e34188d4

  • SHA512

    6507ce97950bb4bcc0f628192d6f0a4aa9e3071f6dbb899e57218671ccc2a13703fad009ca152fb72b8528649c5c548d1e286b8f52045de472d436b33116ee05

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Ton3p6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1m36wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderinfostealerpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1