Extracted

• • Target

    d5c672e7727b4e57143b3f2032d159c5_JaffaCakes118

  • Size

    544KB

  • MD5

    d5c672e7727b4e57143b3f2032d159c5

  • SHA1

    66fb6f627f9da433a851d4c782bfcc5486bfc881

  • SHA256

    9b406407b0987f4d6eb84e8dc3ed65cc27e36626729db7d6e9e5899df11a9b22

  • SHA512

    8e14a9fc159dfb0c2a2afb7373be35b2cf45a1c576d8ab7fc4db444984b6d05c7059239b3bbf7315cbeb2399a79fdc605488bacfb0b26f187be1f93ec72f1be4

  • SSDEEP

    12288:JbinNy0Y1nvEtXBx6DkkJmAGyPexU279WnjVZ6ySWK:1iNy0evmxvkJmApPexUm9cVE

  Score

  10^/10

  xorddosbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalatio

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1