xorddos | fuck[.]elf | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fuck.elf
Size 611KB
Sample220921-1fbneacffr
SHA256 b84cf164fde12dd07192aa44f1b943044610539fd979e0f9359d44062f21a612
MD5 ee5edcc4d824db63a8c8264a8631f067
SHA1 ce483e6b254cc3ed3ede2e1fee3f959cc4eddbe8
SHA512 4a3b98bbea252e8980fc4133eb026a6c673313c6b92a6fc865481c79321cdf24446f651973efbf01fe06794d397d076accedf99b07da0c08d32d3fa4e382bc54
SSDEEP 12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6Ti4x6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWh4fNiGQl/91h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorddos

Malware Config

Extracted

Family

xorddos

C2

.xxxatat456.com:6003
aaa.gggatat456.com:6003
aaa.xxxatat456.com:6003

Signatures

XorDDoS payload 1 IoCs

resource	yara_rule
sample	family_xorddos

Xorddos family
xorddos

File Explorer

fuck.elf

.elf 611KB

fuck.elf

SHA256 b84cf164fde12dd07192aa44f1b943044610539fd979e0f9359d44062f21a612
MD5 ee5edcc4d824db63a8c8264a8631f067
SHA1 ce483e6b254cc3ed3ede2e1fee3f959cc4eddbe8
SHA512 4a3b98bbea252e8980fc4133eb026a6c673313c6b92a6fc865481c79321cdf24446f651973efbf01fe06794d397d076accedf99b07da0c08d32d3fa4e382bc54
SSDEEP 12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6Ti4x6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWh4fNiGQl/91h
MD5 SHA1 SHA512 SSDEEP

linux x86

XorDDoS payload