Overview

overview

10

Static

static

10

4aaa0b0d1c...b3981d

ubuntu-18.04-amd64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
  • Size 659KB
  • Sample221127-wbd6hsfc58
  • SHA256 4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddoslinuxpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • 103.25.9.245:8002

  • 103.240.141.50:8002

  • 66.102.253.30:8002

  • ndns.dsaj2a1.org:8002

  • ndns.dsaj2a.org:8002

  • ndns.hcxiaoao.com:8002

  • ndns.dsaj2a.com:8002

Targets

    • Target
      4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
    • Size 659KB
    • SHA256 4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Write file to user bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks