Extracted

• • Target

    5b9a58a9babe102d41c4be6aafa91694_JaffaCakes118

  • Size

    611KB

  • MD5

    5b9a58a9babe102d41c4be6aafa91694

  • SHA1

    41bddd7de4af0d58af0ad5d294ec6b925372397c

  • SHA256

    ea520d2eb6a7ee8e1caad62bd3e81e6821e63202076cc84c63d7bdff66d64565

  • SHA512

    4447170d69cb672f44810c993de106369aa91831097647e78121270b1154698d0c4d249265263d5d5efc820113a3af64dce7a7f7870fe7ffe93a2f379a63b582

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrRT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNRBVEBl/91h

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1