Extracted

• • Target

    6f651328b7088ae6460724a40faa6c21_JaffaCakes118

  • Size

    647KB

  • MD5

    6f651328b7088ae6460724a40faa6c21

  • SHA1

    8631258fff9828f96629eeaa4fc262b4fabded79

  • SHA256

    fe7c764a7458591fe29e52bf96c74e02fc4fee3d09b455fd67e8c6adb178cf21

  • SHA512

    94566e144586eee595647f27a4ea2ff9cf96a7805b9bf6d6af545ef6613fc7bd05846d31cf544c47a7d59954ffe8b134673746dfa2b8d3cb4c218f212996b912

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Tonfp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mf6wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1