Extracted

• • Target
    09489b80975a6f1a076784f0838c91b5_JaffaCakes118
  • Size 611KB
  • SHA256 32db4c85faf0d58065912af97522befafcfdf73e92a3d549ea11921d25cc6547
  • MD5 09489b80975a6f1a076784f0838c91b5
  • SHA1 a71ebc35aadce35194841607d314c83edd7afa27
  • SHA512 2d42430a5af31d99bb8f38dc456a8ae4f34516a1e20529d0aac6a1cf14cea1270611a3a7c1c2cc0696ea9a04b7167a70e6c6f242cd6086e01c5fd0a2fee77304
  • SSDEEP 12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrkT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNkBVEBl/91h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xorddosantivmbotnetdownloaderinfostealerpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1