Extracted

• • Target

    b8a9cafe1f996d706e621486868238a8_JaffaCakes118

  • Size

    596KB

  • MD5

    b8a9cafe1f996d706e621486868238a8

  • SHA1

    6138c9710cb4e6a7587f4090d2bfe42a1d4e2dc8

  • SHA256

    c4f2b7e9dceb0cfa4f1c21785d148f748906daa12a0bce084bd766e3627cb397

  • SHA512

    b3d1c1c195bf117c6c0945327fb86dba81178d206b7c96b4be2c08a6fa7250d52e0e59cb3ceeffdc99b59baf19205ccebae2a02c3954d824207a54e8aebf24fd

  • SSDEEP

    12288:bfTGy+n69+5rTlFEcMWbHvx5SGEuWd5F6yxm9Ah7Dxu9hc7L:rTG/0+5dq4bHvx5SGod5LTD4XcP

  Score

  10^/10

  xorddosbotnetdownloaderrootkit

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Writes memory of remote process

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1