Extracted

• • Target

    0d6cb79acdb715f4198b6133f574e394_JaffaCakes118

  • Size

    611KB

  • MD5

    0d6cb79acdb715f4198b6133f574e394

  • SHA1

    caf8b5d6293b044bd9ae4d9498c1cf858c3f47f8

  • SHA256

    02ab39d5ef83ffd09e3774a67b783bfa345505d3cb86694c5b0f0c94980e5ae8

  • SHA512

    e993af195bfb7f66d1702c551aefbab78f7542394e7365bb6f53c4ce677d98ccfd9a44cfda8ffb97939d2998c863edcabb6b9c782d0ca08f8703ff3c34159a5f

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr9T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN9BVEBl/91h

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1