Extracted

• • Target

    3291432c0084225333ee57320404e655_JaffaCakes118

  • Size

    611KB

  • MD5

    3291432c0084225333ee57320404e655

  • SHA1

    96a637393566a51222a87f3588b01e021faac651

  • SHA256

    2409fb21fe377f7e12dda392f26d7c93b7715239169d362dd907fe499ab38ee9

  • SHA512

    d86e86246063a6bb4d7c09d5c4e52af5904458b489b7dc21b0c795b32981482545c4a7f757892a2a2fec7af092986480642e8990e74f12ec6e26a17e328535cb

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr/T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN/BVEBl/91h

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalatio

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1