Extracted

• • Target
    jaffacakes118_5de642254997f98f739385c3101e1339bd44f559fe4bec3bf4da70a15ccb4f80
  • Size 611KB
  • SHA256 5de642254997f98f739385c3101e1339bd44f559fe4bec3bf4da70a15ccb4f80
  • MD5 ad9b44e5f5e17a54b3a9b9a28ebae333
  • SHA1 8560e71b35a9655d3d5610459f29f8553fc11a9f
  • SHA512 7b1841308fc0b1a38102dbd3ae3e42c5873ed71a1c3db711b19c55d3f1a157df65a687c4396148860b74df7d7b862364025ca637df0ba54242dc90f870faedfe
  • SSDEEP 12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrlT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNlBVEBl/91h
  • TLSH
    T159D47D06F243EAF7C4970570124BF7BF4230E6318412DF8AB6889D5AB9379F52A4E356
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoverydownloaderexecutionxorddospersistenceprivilege_escalation

  • Family: XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1