Overview

overview

10

Static

static

10

atrdadsrcc

ubuntu-18.04-amd64

7

Resubmissions

20/04/2023, 08:22

230420-j9nrdsae7110

15/03/2023, 16:53

230315-vd9vjaec8910

27/11/2022, 17:44

221127-wbfpcaah7t10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2154547c69bf8bee7f296bd8ce56ffa4115da65c2308e9fc6d5079b2eb9dec93
  • Size 301KB
  • Sample221127-wbfpcaah7t
  • SHA256 2154547c69bf8bee7f296bd8ce56ffa4115da65c2308e9fc6d5079b2eb9dec93
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddoslinuxpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • 103.25.9.245:8002

  • 103.240.141.50:8002

  • 66.102.253.30:8002

  • ndns.dsaj2a1.org:8002

  • ndns.dsaj2a.org:8002

  • ndns.hcxiaoao.com:8002

  • ndns.dsaj2a.com:8002

Targets

    • Target
      atrdadsrcc
    • Size 659KB
    • SHA256 4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Write file to user bin folder

    • Reads runtime system information

      Reads data from /proc virtual filesystem.

    • Writes file to tmp directory

      Malware often drops required files in the /tmp directory.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks