Extracted

• • Target

    a37bf50d53fb2409c16d7007d018cc8d_JaffaCakes118

  • Size

    611KB

  • MD5

    a37bf50d53fb2409c16d7007d018cc8d

  • SHA1

    4fa2128dd1d4fce1266de321c94fc8d3b353a956

  • SHA256

    b81e95eb2f1fd0deaa4c1873d306003148928bcf5b9394e99c56974d80817f5d

  • SHA512

    b757f859f7d42ac0a30abcfeb1fea990194fc4dd8894275151d594319332e3e63a19fcf20493dee1380df6a4d0123eca4f6dc303180aed100e83ba38fe30ee0c

  • SSDEEP

    12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6Ti2x6yB1/aGK4UlUuTh1AS:UB1BVpmExDYp38X8LYTWh2fNaGQl/91v

  Score

  10^/10

  xorddosbotnetdownloaderrootkit

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Writes memory of remote process

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1