Extracted

• • Target

    8195401195f52008f2680bd3f1d17ec8_JaffaCakes118

  • Size

    610KB

  • MD5

    8195401195f52008f2680bd3f1d17ec8

  • SHA1

    7a21e5bf147c1e2bc9041b9111b8d3d34f4adddf

  • SHA256

    afb23b7eb037423c3a6b3c8d28bd8b6ef7f8d3ebc9615ce91292e5a2c067dda4

  • SHA512

    b580d70ac7d27759222377b1e55dc1d07659d908ceb99d1bf0359bfa8b3eac2ec23b62c73703cc46ab770aebf94c007d198f6241ef5be74406b0074dc1948f7e

  • SSDEEP

    12288:WBxHsnhar0nJ7FGY5HRYxC1mqiL40qFCWU7k/rU6yZNnXgW4UlUuTh1Ac:WBxHgaUVFGAR11mTL40q/ZGpXgUl/91x

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1