Extracted

• • Target

    9e3f2816aedb9f6fcf1b614c0a9aa0f3_JaffaCakes118

  • Size

    647KB

  • MD5

    9e3f2816aedb9f6fcf1b614c0a9aa0f3

  • SHA1

    53bc1cef220187799bfba92fe7a709f0ef5f18b1

  • SHA256

    77eaa6e5b8111228cba1de51b04f96676513736b18834bde2d35de4e1a1cf032

  • SHA512

    676414a067309a7d80e5e149f794feb6a264ca1db77cd47cce385b1d2c182cfaa936127dbb9d0d49b81e4be8e328a7f19c85c615fe4178b14e11b0c12ead9033

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1TonTp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mT6wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderinfostealerpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1