Extracted

• • Target

    7b3e0b3c4420b86c1c9e19626deb9beb_JaffaCakes118

  • Size

    647KB

  • MD5

    7b3e0b3c4420b86c1c9e19626deb9beb

  • SHA1

    33094eb2502965d98f6885e7b3dd801c1e4ef914

  • SHA256

    08a241e035c5702ebe46a89faf6a6e9544acf3a9d8f54e41aca69c508d193e24

  • SHA512

    34ec5d04c0cc5e9187dd53fe752420672e36b073371c250ff7069c9db9e0f216c22e9af54abfb2b7b38e4de868611387c6a5b67a8ca2aa7ccad7f06e953c6519

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Tonvp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mv6wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1