Overview

overview

10

Static

static

10

nyynvefzjerks

ubuntu-18.04-amd64

9

Resubmissions

20/04/2023, 08:22

230420-j9pnpaae8s10

20/04/2023, 08:22

230420-j9pcxsge7310

15/03/2023, 12:40

230315-pwcd4afc4t10

15/03/2023, 12:39

230315-pvsdxsdb5510

13/03/2023, 14:43

230313-r3ya9aag6710

24/08/2021, 03:35

210824-ycawpc5ms29

Sharing

Copy URL Twitter E-mail

General

  • Target
    nyynvefzjerks
  • Size 546KB
  • Sample230315-pvsdxsdb55
  • SHA256 c9bd6d01eb7258fef88ec5c9276431c1db45f063b316f83943e45b6a40a76783
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddoslinuxpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • topbannersun.com:5993

  • wowapplecar.com:5993

Targets

    • Target
      nyynvefzjerks
    • Size 546KB
    • SHA256 c9bd6d01eb7258fef88ec5c9276431c1db45f063b316f83943e45b6a40a76783
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    persistence

    • Writes file to system bin folder

    • Modifies rc script

      Adding/modifying system rc scripts is a common persistence mechanism.

      persistence

    • Writes file to shm directory

      Malware can drop malicious files in the shm directory which will run directly from RAM.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks