Extracted

• • Target

    ea1eefeca5af73afad4f6ca0284da736_JaffaCakes118

  • Size

    605KB

  • MD5

    ea1eefeca5af73afad4f6ca0284da736

  • SHA1

    12cd4bffb129f91370d1edcf94747de3bdcb3305

  • SHA256

    834eb864a29471d0abe178068c259470e4403eb546554247e2f5832acf9586ab

  • SHA512

    43fcdd9c79d9c90b5e34242e5293565905ca20f3d1f486f7d5b02f4e90f7c5b6f92c6dbce84ebf96f77e5a70d031a4593202a75ff948e3b683e10b42d44e0ff1

  • SSDEEP

    12288:IB7tZvFfN5nyhPR6SVsqrcdfUBFLlGNZBjHoPEh6y/KD0lwMogq3whrAZ2:IB7Jfryh5dsqifUBFLlGNZpVlW0lMgqg

  Score

  10^/10

  xorddosbotnetdownloaderrootkit

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Writes memory of remote process

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1