General
-
Target
0fe237d7331d592e309a2f26aaf7f0704dda310fff938fdb59c7e1712669cb89
-
Size
611KB
-
Sample
220604-rhg4jaegcr
-
MD5
933300a75506670e953544c3de84de23
-
SHA1
60884e2db647c6228d96c484b1609863736cb215
-
SHA256
0fe237d7331d592e309a2f26aaf7f0704dda310fff938fdb59c7e1712669cb89
-
SHA512
4ea23a6abbe38515da42ed3f4a820c8e41ff82666d1d489cda804dfcbf15bb63f6447be8ff35fb828790f10c13bc294861be2526d44f5dac8905f8b0d493cb18
Static task
static1
Behavioral task
behavioral1
Sample
0fe237d7331d592e309a2f26aaf7f0704dda310fff938fdb59c7e1712669cb89
Resource
ubuntu1804-amd64-en-20211208
Malware Config
Extracted
xorddos
ppp.gggatat456.com:53
ppp.xxxatat456.com:53
p5.dddgata789.com:53
p5.lpjulidny7.com:53
Targets
-
-
Target
0fe237d7331d592e309a2f26aaf7f0704dda310fff938fdb59c7e1712669cb89
-
Size
611KB
-
MD5
933300a75506670e953544c3de84de23
-
SHA1
60884e2db647c6228d96c484b1609863736cb215
-
SHA256
0fe237d7331d592e309a2f26aaf7f0704dda310fff938fdb59c7e1712669cb89
-
SHA512
4ea23a6abbe38515da42ed3f4a820c8e41ff82666d1d489cda804dfcbf15bb63f6447be8ff35fb828790f10c13bc294861be2526d44f5dac8905f8b0d493cb18
Score10/10-
suricata: ET MALWARE DDoS.XOR Checkin via HTTP
suricata: ET MALWARE DDoS.XOR Checkin via HTTP
-
Writes file to system bin folder
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Write file to user bin folder
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-