Extracted

• • Target

    12d5d743f029662fa0d4c7d224d2f117_JaffaCakes118

  • Size

    611KB

  • MD5

    12d5d743f029662fa0d4c7d224d2f117

  • SHA1

    edd29da20cd95e494e8bfc84b6905a79505fb207

  • SHA256

    c98669337e18ede65029f72655341a23d999a72966ce6c89ac813b2ffcf02ad3

  • SHA512

    bcaff169cb7c0303fd399f14284647195d4bac54cc4d84814b2c70f379e7ea75605d9ce5fb2b64b49ecd61745ccbe65415cdd30b4ecf82f9e6ac90dd3d4f3959

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr1T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN1BVEBl/91h

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1