General
-
Target
c68f654c233339eb4a4b4b06f4f8774bf05e660e46e7dfee0f70984b1b71d6a0
-
Size
611KB
-
Sample
220604-tythlsehh9
-
MD5
0f2e17e5c1bdb05be19f60aee17946bc
-
SHA1
e37b85fb0ad5ed80f01b0e609efe735130427f0d
-
SHA256
c68f654c233339eb4a4b4b06f4f8774bf05e660e46e7dfee0f70984b1b71d6a0
-
SHA512
74a09bdb821b3319687a5bac44fad078297ed3ef2f9ef018581c1cc706b4bed2f7d89430af8a6b12e1829664efb0dd382db0889e6f158ffbac3d14911c1bc639
Static task
static1
Behavioral task
behavioral1
Sample
c68f654c233339eb4a4b4b06f4f8774bf05e660e46e7dfee0f70984b1b71d6a0
Resource
ubuntu1804-amd64-en-20211208
Malware Config
Extracted
xorddos
ppp.gggatat456.com:53
ppp.xxxatat456.com:53
p5.dddgata789.com:53
p5.lpjulidny7.com:53
Targets
-
-
Target
c68f654c233339eb4a4b4b06f4f8774bf05e660e46e7dfee0f70984b1b71d6a0
-
Size
611KB
-
MD5
0f2e17e5c1bdb05be19f60aee17946bc
-
SHA1
e37b85fb0ad5ed80f01b0e609efe735130427f0d
-
SHA256
c68f654c233339eb4a4b4b06f4f8774bf05e660e46e7dfee0f70984b1b71d6a0
-
SHA512
74a09bdb821b3319687a5bac44fad078297ed3ef2f9ef018581c1cc706b4bed2f7d89430af8a6b12e1829664efb0dd382db0889e6f158ffbac3d14911c1bc639
Score10/10-
suricata: ET MALWARE DDoS.XOR Checkin via HTTP
suricata: ET MALWARE DDoS.XOR Checkin via HTTP
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Writes file to system bin folder
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Write file to user bin folder
-
Reads runtime system information
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory
Malware often drops required files in the /tmp directory.
-