Extracted

• • Target
    4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
  • Size 549KB
  • SHA256 4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
  • MD5 63d6cd74a7cd01bf3a3921c36e90237f
  • SHA1 f697783da228c7787cf1c6a67a10a8c065d6aaa7
  • SHA512 51b1aef53c8277b8700630b144f15c9a41df358a43d71ef0b9352bbdf71c8777774f1ef1e361c8c95930143b54fcde590885242df3da60dce5b1a1d3761e2db3
  • SSDEEP 12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Deletes itself

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Executes dropped EXE

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes file to shm directory

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Reads system network configuration

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  behavioral1