Extracted

• • Target

    7a891a96d6af45865e5fe6142b40eb77_JaffaCakes118

  • Size

    610KB

  • MD5

    7a891a96d6af45865e5fe6142b40eb77

  • SHA1

    674ad6a918d4dc38c4c03860da2fddcd5da61b57

  • SHA256

    cfa4c887555c315182f2a4dc290633fdec3140a10e4480e877ff1a7627d89878

  • SHA512

    9d4900c38200643b15320dbbeec6b06b3597398abe2fd31e1965e1d224baa008edbfa4b5dbc9cab00e33a70f5a0b1892fc6d540fd440779f69df08d99248da37

  • SSDEEP

    12288:WBmHsnhar0nJ7FGY5HRYxC1mqiL40qFCWU7k/VU6yZNnXgW4UlUuTh1AG:WBmHgaUVFGAR11mTL40q/7GpXgUl/91h

  Score

  10^/10

  xorddosantivmbotnetdownloaderinfostealerpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1