Extracted

• • Target

    f45232c67ef011ef988747e6d9bbb443_JaffaCakes118

  • Size

    611KB

  • MD5

    f45232c67ef011ef988747e6d9bbb443

  • SHA1

    4d7f2efa2762d3a6016a3b1ab4df4c20992da511

  • SHA256

    5022e32cf32a67337aec601a2078c7194c80d196c18a5e972ed6f23c276fd03f

  • SHA512

    6a5bb40f6250c24e33367fd262f34da7b06355e3304ca6c442ee1ba9b0efbff58ecc90a9a0bec96483cec809796fcb31610380f5a36f745fd80ca642a3f94725

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrriT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNiBVEBl/91h

  Score

  10^/10

  xorddosbotnetdiscoverydownloaderexecutioninfostealerpersistenceprivilege_escalatio

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1