Extracted

• • Target
    d24e975bd11c5e17ce8fa6a5b8ab52ca_JaffaCakes118
  • Size 596KB
  • SHA256 a52428f16f891e1a17375cbee34fdb68c83632988e7b1ae1590bacda2724cc0b
  • MD5 d24e975bd11c5e17ce8fa6a5b8ab52ca
  • SHA1 e83557dce06c238a6c2d04ec7da00d908c90c82e
  • SHA512 16cb95f72708869d75c9e4f63d1cb5fa95ccddb9460fc6a4bc8c3837e46df512a8e4e87bf24e7e9ae9b44357536694fa96308a1436cdb7e6ac1609f192f3dc60
  • SSDEEP 12288:rPTJS+naeW9kclFEcMWbHdxZ7GkR2fo/6y9P/YAh7Dxu9hc7L:DTJfrW99q4bHdxZ7G1foFND4XcP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xorddosbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalatiorootkit

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Writes memory of remote process

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  behavioral1