Overview

overview

10

Static

static

10

xlzyktus

ubuntu-18.04-amd64

10

Resubmissions

04/07/2023, 02:19

230704-crvzescc2v

12/05/2023, 10:49

230512-mw2b4sfa3x10

Analysis

  • max time kernel
    44s
  • max time network
    104s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    12/05/2023, 10:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xlzyktus
  • Size 549KB
  • Sample230512-mw2b4sfa3x
  • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddosbotnetdownloaderpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • www.imagetw0.com:889

  • www.myserv012.com:889

  • http://qq.com/lib.asp

Attributes
  • crc_polynomial

    CDB88320

xor.plain

Signatures

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos
  • XorDDoS payload 37 IoCs
  • Writes file to system bin folder 1 TTPs 36 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Deletes itself 37 IoCs
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

  • Executes dropped EXE 37 IoCs
  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes file to shm directory 2 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 51 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xlzyktus
    /tmp/xlzyktus
    1⤵
      PID:597
    • /bin/slynakx
      /bin/slynakx -d 598
      1⤵
        PID:602
      • /bin/ekrmyvmcxblw
        /bin/ekrmyvmcxblw -d 598
        1⤵
          PID:609
        • /bin/ohqiypm
          /bin/ohqiypm -d 598
          1⤵
            PID:612
          • /bin/crtbvqcywopj
            /bin/crtbvqcywopj -d 598
            1⤵
              PID:615
            • /bin/xrkaeiwsqocog
              /bin/xrkaeiwsqocog -d 598
              1⤵
              • Executes dropped EXE
              PID:618
            • /bin/zplofscp
              /bin/zplofscp -d 598
              1⤵
                PID:621
              • /bin/reqcokcaujgjgf
                /bin/reqcokcaujgjgf -d 598
                1⤵
                • Deletes itself
                PID:624
              • /bin/wfxttpsjci
                /bin/wfxttpsjci -d 598
                1⤵
                • Executes dropped EXE
                PID:627
              • /bin/lflekbhynlahu
                /bin/lflekbhynlahu -d 598
                1⤵
                  PID:630
                • /bin/cnxpkcpdxeyi
                  /bin/cnxpkcpdxeyi -d 598
                  1⤵
                  • Deletes itself
                  PID:633
                • /bin/zforvfq
                  /bin/zforvfq -d 598
                  1⤵
                  • Executes dropped EXE
                  PID:636
                • /bin/egiepihvm
                  /bin/egiepihvm -d 598
                  1⤵
                    PID:639
                  • /bin/kzbyqmr
                    /bin/kzbyqmr -d 598
                    1⤵
                    • Deletes itself
                    PID:642
                  • /bin/aqcfhucomdo
                    /bin/aqcfhucomdo -d 598
                    1⤵
                    • Executes dropped EXE
                    PID:645
                  • /bin/lyuagdvusitt
                    /bin/lyuagdvusitt -d 598
                    1⤵
                      PID:648
                    • /bin/uigljps
                      /bin/uigljps -d 598
                      1⤵
                      • Deletes itself
                      PID:651
                    • /bin/xkmfwxgqd
                      /bin/xkmfwxgqd -d 598
                      1⤵
                      • Executes dropped EXE
                      PID:654
                    • /bin/sxhwdscw
                      /bin/sxhwdscw -d 598
                      1⤵
                      • Deletes itself
                      PID:657
                    • /bin/tjlnrtydls
                      /bin/tjlnrtydls -d 598
                      1⤵
                        PID:660
                      • /bin/rlwwivfybktyrp
                        /bin/rlwwivfybktyrp -d 598
                        1⤵
                        • Executes dropped EXE
                        PID:663
                      • /bin/yhmduyvfjxm
                        /bin/yhmduyvfjxm -d 598
                        1⤵
                          PID:666
                        • /bin/yrbrzjt
                          /bin/yrbrzjt -d 598
                          1⤵
                          • Deletes itself
                          PID:669
                        • /bin/sgsjtjcyaafnfb
                          /bin/sgsjtjcyaafnfb -d 598
                          1⤵
                          • Executes dropped EXE
                          PID:672
                        • /bin/cgwztvxnvoqmp
                          /bin/cgwztvxnvoqmp -d 598
                          1⤵
                            PID:675
                          • /bin/uoldhwhf
                            /bin/uoldhwhf -d 598
                            1⤵
                            • Deletes itself
                            PID:678
                          • /bin/jfcxjtbg
                            /bin/jfcxjtbg -d 598
                            1⤵
                            • Executes dropped EXE
                            PID:681
                          • /bin/xfijxhkvp
                            /bin/xfijxhkvp -d 598
                            1⤵
                              PID:684
                            • /bin/fcnkjqc
                              /bin/fcnkjqc -d 598
                              1⤵
                              • Deletes itself
                              PID:687
                            • /bin/qduvfu
                              /bin/qduvfu -d 598
                              1⤵
                              • Executes dropped EXE
                              PID:690
                            • /bin/avnxsufdt
                              /bin/avnxsufdt -d 598
                              1⤵
                                PID:693
                              • /bin/hwgqmruyjtrco
                                /bin/hwgqmruyjtrco -d 598
                                1⤵
                                • Deletes itself
                                PID:698
                              • /bin/ebrzzdlltupxg
                                /bin/ebrzzdlltupxg -d 598
                                1⤵
                                • Executes dropped EXE
                                PID:701
                              • /bin/fisnaefudoqwqe
                                /bin/fisnaefudoqwqe -d 598
                                1⤵
                                • Deletes itself
                                PID:704
                              • /bin/kizejyhv
                                /bin/kizejyhv -d 598
                                1⤵
                                  PID:707
                                • /bin/braaabuhlo
                                  /bin/braaabuhlo -d 598
                                  1⤵
                                  • Executes dropped EXE
                                  PID:710
                                • /bin/ykgotbscqv
                                  /bin/ykgotbscqv -d 598
                                  1⤵
                                  • Deletes itself
                                  PID:713
                                • /bin/atdtnuxeml
                                  /bin/atdtnuxeml -d 598
                                  1⤵
                                    PID:716

                                  Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        aqcfhucomdo
                                        • Path /bin/aqcfhucomdo
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        atdtnuxeml
                                        • Path /bin/atdtnuxeml
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        avnxsufdt
                                        • Path /bin/avnxsufdt
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        braaabuhlo
                                        • Path /bin/braaabuhlo
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        cgwztvxnvoqmp
                                        • Path /bin/cgwztvxnvoqmp
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        cnxpkcpdxeyi
                                        • Path /bin/cnxpkcpdxeyi
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        crtbvqcywopj
                                        • Path /bin/crtbvqcywopj
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        ebrzzdlltupxg
                                        • Path /bin/ebrzzdlltupxg
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        egiepihvm
                                        • Path /bin/egiepihvm
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        ekrmyvmcxblw
                                        • Path /bin/ekrmyvmcxblw
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        fcnkjqc
                                        • Path /bin/fcnkjqc
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        fisnaefudoqwqe
                                        • Path /bin/fisnaefudoqwqe
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        hmnlavjmbz
                                        • Path /bin/hmnlavjmbz
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        hwgqmruyjtrco
                                        • Path /bin/hwgqmruyjtrco
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        kizejyhv
                                        • Path /bin/kizejyhv
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        kzbyqmr
                                        • Path /bin/kzbyqmr
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        lflekbhynlahu
                                        • Path /bin/lflekbhynlahu
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        lyuagdvusitt
                                        • Path /bin/lyuagdvusitt
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        ohqiypm
                                        • Path /bin/ohqiypm
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        qduvfu
                                        • Path /bin/qduvfu
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        reqcokcaujgjgf
                                        • Path /bin/reqcokcaujgjgf
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        rlwwivfybktyrp
                                        • Path /bin/rlwwivfybktyrp
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        sgsjtjcyaafnfb
                                        • Path /bin/sgsjtjcyaafnfb
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        slynakx
                                        • Path /bin/slynakx
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        sxhwdscw
                                        • Path /bin/sxhwdscw
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        tjlnrtydls
                                        • Path /bin/tjlnrtydls
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        uigljps
                                        • Path /bin/uigljps
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        uoldhwhf
                                        • Path /bin/uoldhwhf
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        wfxttpsjci
                                        • Path /bin/wfxttpsjci
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        xfijxhkvp
                                        • Path /bin/xfijxhkvp
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        xkmfwxgqd
                                        • Path /bin/xkmfwxgqd
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        xrkaeiwsqocog
                                        • Path /bin/xrkaeiwsqocog
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        ykgotbscqv
                                        • Path /bin/ykgotbscqv
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        yrbrzjt
                                        • Path /bin/yrbrzjt
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        zforvfq
                                        • Path /bin/zforvfq
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        zplofscp
                                        • Path /bin/zplofscp
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        sem.u7gFm1
                                        • Path /dev/shm/sem.u7gFm1
                                        • Size 16B
                                        • SHA256 4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        sutkyzlx.sh
                                        • Path /etc/cron.hourly/sutkyzlx.sh
                                        • Size 145B
                                        • SHA256 9dbc8d99c61c08ad6552c50b6fd0a3acb10baf9415d76e562568d8b75ede2a07
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        daemon.cfg
                                        • Path /etc/daemon.cfg
                                        • Size 32B
                                        • SHA256 de69d867da7b53e540a7147de31dfd8c789ca4dd83cb048159c0d3bdbc7ea2ad
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        sutkyzlx
                                        • Path /etc/init.d/sutkyzlx
                                        • Size 328B
                                        • SHA256 933ce1e55998d5106f44483e5fece27b9bec521be3728e5b9c9cbe18ea1a9f53
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        sutkyzlx
                                        • Path /tmp/sutkyzlx
                                        • Size 549KB
                                        • SHA256 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download