xorddos | 311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

Analysis

max time kernel
54s
max time network
55s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221125-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221125-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
14-05-2023 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xlzyktus.elf
Size

549KB
MD5

895f7fff165ddfba70b7d718ac3de989
SHA1

2663c2ebb853083f5cf645cdc0cce31c8ace4fba
SHA256

311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151
SHA512

c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmxd:VIv/qiVNHNDEfJKHZ8mG9QeeOd

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

www.imagetw0.com:889

www.myserv012.com:889

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 37 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_xorddos
behavioral1/files/fstream-11.dat	family_xorddos
behavioral1/files/fstream-13.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos
behavioral1/files/fstream-17.dat	family_xorddos
behavioral1/files/fstream-19.dat	family_xorddos
behavioral1/files/fstream-21.dat	family_xorddos
behavioral1/files/fstream-23.dat	family_xorddos
behavioral1/files/fstream-25.dat	family_xorddos
behavioral1/files/fstream-27.dat	family_xorddos
behavioral1/files/fstream-29.dat	family_xorddos
behavioral1/files/fstream-31.dat	family_xorddos
behavioral1/files/fstream-33.dat	family_xorddos
behavioral1/files/fstream-35.dat	family_xorddos
behavioral1/files/fstream-37.dat	family_xorddos
behavioral1/files/fstream-39.dat	family_xorddos
behavioral1/files/fstream-41.dat	family_xorddos
behavioral1/files/fstream-43.dat	family_xorddos
behavioral1/files/fstream-45.dat	family_xorddos
behavioral1/files/fstream-47.dat	family_xorddos
behavioral1/files/fstream-49.dat	family_xorddos
behavioral1/files/fstream-53.dat	family_xorddos
behavioral1/files/fstream-55.dat	family_xorddos
behavioral1/files/fstream-57.dat	family_xorddos
behavioral1/files/fstream-59.dat	family_xorddos
behavioral1/files/fstream-61.dat	family_xorddos
behavioral1/files/fstream-63.dat	family_xorddos
behavioral1/files/fstream-65.dat	family_xorddos
behavioral1/files/fstream-67.dat	family_xorddos
behavioral1/files/fstream-69.dat	family_xorddos
behavioral1/files/fstream-71.dat	family_xorddos
behavioral1/files/fstream-73.dat	family_xorddos
behavioral1/files/fstream-75.dat	family_xorddos
behavioral1/files/fstream-77.dat	family_xorddos
behavioral1/files/fstream-79.dat	family_xorddos
behavioral1/files/fstream-83.dat	family_xorddos
behavioral1/files/fstream-85.dat	family_xorddos

Writes file to system bin folder 1 TTPs 36 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/bin/fkaszdsix
File opened for modification	/bin/aqxujqsgiilbv
File opened for modification	/bin/bbaglkmegu
File opened for modification	/bin/gztgaupre
File opened for modification	/bin/dpnyxa
File opened for modification	/bin/cjmsfnu
File opened for modification	/bin/dylzlgsfmfzzy
File opened for modification	/bin/srbgrvpvv
File opened for modification	/bin/uswopprjgvp
File opened for modification	/bin/lmciktfb
File opened for modification	/bin/mmgtynagq
File opened for modification	/bin/acbwapwgh
File opened for modification	/bin/orogstabtlzli
File opened for modification	/bin/uqorkebtvlxo
File opened for modification	/bin/wkpksx
File opened for modification	/bin/ohwqcdvrg
File opened for modification	/bin/vxhdevrx
File opened for modification	/bin/lmcyvuukhw
File opened for modification	/bin/dfylavgfnbx
File opened for modification	/bin/nsqztocjnyvesb
File opened for modification	/bin/pqfsov
File opened for modification	/bin/fybmosijqbyvo
File opened for modification	/bin/nkpoli
File opened for modification	/bin/untgubwazl
File opened for modification	/bin/xqhatcl
File opened for modification	/bin/joowwpxuoj
File opened for modification	/bin/wgivhws
File opened for modification	/bin/vqpulvoohrfxqc
File opened for modification	/bin/prxhtdmc
File opened for modification	/bin/ietenwphkh
File opened for modification	/bin/hcozsjkpba
File opened for modification	/bin/bbivvtc
File opened for modification	/bin/cyymqejgig
File opened for modification	/bin/pljfdgc
File opened for modification	/bin/llowyv
File opened for modification	/bin/kwgqxzox

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc
File opened for modification	/etc/cron.hourly/fle.sutkyzlx.sh

Deletes itself 37 IoCs

pid	Process
621	hcozsjkpba
624	fkaszdsix
627	cjmsfnu
630	dylzlgsfmfzzy
632	srbgrvpvv
636	kwgqxzox
639	wgivhws
641	lmcyvuukhw
644	bbivvtc
647	pqfsov
650	zzrmfxwinxqo
654	Process not Found
657	Process not Found
660	Process not Found
662	Process not Found
665	Process not Found
668	Process not Found
671	Process not Found
674	Process not Found
677	Process not Found
681	Process not Found
683	Process not Found
686	Process not Found
691	Process not Found
694	Process not Found
697	Process not Found
700	Process not Found
704	Process not Found
707	Process not Found
709	Process not Found
713	Process not Found
716	Process not Found
718	Process not Found
721	Process not Found
724	Process not Found
729	Process not Found
730	Process not Found

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Executes dropped EXE 37 IoCs

pid	Process
619	llowyv
622	uqorkebtvlxo
625	acbwapwgh
628	vxhdevrx
631	wkpksx
634	uswopprjgvp
637	lmciktfb
640	aqxujqsgiilbv
643	dpnyxa
646	dfylavgfnbx
649	ohwqcdvrg
652	Process not Found
655	Process not Found
658	Process not Found
661	Process not Found
664	Process not Found
667	Process not Found
670	Process not Found
673	Process not Found
676	Process not Found
679	Process not Found
682	Process not Found
685	Process not Found
688	Process not Found
693	Process not Found
696	Process not Found
699	Process not Found
702	Process not Found
705	Process not Found
708	Process not Found
711	Process not Found
714	Process not Found
717	Process not Found
720	Process not Found
723	Process not Found
726	Process not Found
728	Process not Found

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/fle.sutkyzlx

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc
File opened for modification	/dev/shm/sem.scdcht
File opened for modification	/dev/shm/sem.4YwZ72

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 50 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/681/fd
File opened for reading	/proc/448/fd
File opened for reading	/proc/612/fd
File opened for reading	/proc/384/fd
File opened for reading	/proc/624/fd
File opened for reading	/proc/691/fd
File opened for reading	/proc/694/fd
File opened for reading	/proc/704/fd
File opened for reading	/proc/709/fd
File opened for reading	/proc/345/fd
File opened for reading	/proc/351/fd
File opened for reading	/proc/718/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/630/fd
File opened for reading	/proc/641/fd
File opened for reading	/proc/647/fd
File opened for reading	/proc/660/fd
File opened for reading	/proc/662/fd
File opened for reading	/proc/707/fd
File opened for reading	/proc/253/fd
File opened for reading	/proc/447/fd
File opened for reading	/proc/721/fd
File opened for reading	/proc/713/fd
File opened for reading	/proc/716/fd
File opened for reading	/proc/343/fd
File opened for reading	/proc/391/fd
File opened for reading	/proc/585/fd
File opened for reading	/proc/604/fd
File opened for reading	/proc/627/fd
File opened for reading	/proc/700/fd
File opened for reading	/proc/290/fd
File opened for reading	/proc/291/fd
File opened for reading	/proc/724/fd
File opened for reading	/proc/639/fd
File opened for reading	/proc/644/fd
File opened for reading	/proc/650/fd
File opened for reading	/proc/686/fd
File opened for reading	/proc/231/fd
File opened for reading	/proc/632/fd
File opened for reading	/proc/429/fd
File opened for reading	/proc/683/fd
File opened for reading	/proc/361/fd
File opened for reading	/proc/367/fd
File opened for reading	/proc/431/fd
File opened for reading	/proc/636/fd
File opened for reading	/proc/654/fd
File opened for reading	/proc/657/fd
File opened for reading	/proc/346/fd
File opened for reading	/proc/355/fd
File opened for reading	/proc/697/fd

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/fle.sutkyzlx
File opened for modification	/tmp/fle.sutkyzlx.sh

/tmp/xlzyktus.elf
/tmp/xlzyktus.elf
1⤵
PID:609

/bin/prxhtdmc
/bin/prxhtdmc -d 610
1⤵
PID:619

/bin/bbaglkmegu
/bin/bbaglkmegu -d 610
1⤵
PID:622

/bin/pljfdgc
/bin/pljfdgc -d 610
1⤵
PID:625

/bin/untgubwazl
/bin/untgubwazl -d 610
1⤵
PID:628

/bin/llowyv
/bin/llowyv -d 610
1⤵
- Executes dropped EXE
PID:631

/bin/ietenwphkh
/bin/ietenwphkh -d 610
1⤵
PID:634

/bin/hcozsjkpba
/bin/hcozsjkpba -d 610
1⤵
- Deletes itself
PID:637

/bin/uqorkebtvlxo
/bin/uqorkebtvlxo -d 610
1⤵
- Executes dropped EXE
PID:640

/bin/mmgtynagq
/bin/mmgtynagq -d 610
1⤵
PID:643

/bin/fkaszdsix
/bin/fkaszdsix -d 610
1⤵
- Deletes itself
PID:646

/bin/acbwapwgh
/bin/acbwapwgh -d 610
1⤵
- Executes dropped EXE
PID:649

/bin/orogstabtlzli
/bin/orogstabtlzli -d 610
1⤵
PID:652

/bin/cjmsfnu
/bin/cjmsfnu -d 610
1⤵
- Deletes itself
PID:655

/bin/vxhdevrx
/bin/vxhdevrx -d 610
1⤵
- Executes dropped EXE
PID:658

/bin/xqhatcl
/bin/xqhatcl -d 610
1⤵
PID:661

/bin/dylzlgsfmfzzy
/bin/dylzlgsfmfzzy -d 610
1⤵
- Deletes itself
PID:664

/bin/wkpksx
/bin/wkpksx -d 610
1⤵
- Executes dropped EXE
PID:667

/bin/srbgrvpvv
/bin/srbgrvpvv -d 610
1⤵
- Deletes itself
PID:670

/bin/joowwpxuoj
/bin/joowwpxuoj -d 610
1⤵
PID:673

/bin/uswopprjgvp
/bin/uswopprjgvp -d 610
1⤵
- Executes dropped EXE
PID:676

/bin/pabbjr
/bin/pabbjr -d 610
1⤵
PID:679

/bin/kwgqxzox
/bin/kwgqxzox -d 610
1⤵
- Deletes itself
PID:682

/bin/lmciktfb
/bin/lmciktfb -d 610
1⤵
- Executes dropped EXE
PID:685

/bin/gztgaupre
/bin/gztgaupre -d 610
1⤵
PID:688

/bin/wgivhws
/bin/wgivhws -d 610
1⤵
- Deletes itself
PID:693

/bin/aqxujqsgiilbv
/bin/aqxujqsgiilbv -d 610
1⤵
- Executes dropped EXE
PID:696

/bin/lmcyvuukhw
/bin/lmcyvuukhw -d 610
1⤵
- Deletes itself
PID:699

/bin/nsqztocjnyvesb
/bin/nsqztocjnyvesb -d 610
1⤵
PID:702

/bin/dpnyxa
/bin/dpnyxa -d 610
1⤵
- Executes dropped EXE
PID:705

/bin/bbivvtc
/bin/bbivvtc -d 610
1⤵
- Deletes itself
PID:708

/bin/vqpulvoohrfxqc
/bin/vqpulvoohrfxqc -d 610
1⤵
PID:711

/bin/dfylavgfnbx
/bin/dfylavgfnbx -d 610
1⤵
- Executes dropped EXE
PID:714

/bin/pqfsov
/bin/pqfsov -d 610
1⤵
- Deletes itself
PID:717

/bin/cyymqejgig
/bin/cyymqejgig -d 610
1⤵
PID:720

/bin/ohwqcdvrg
/bin/ohwqcdvrg -d 610
1⤵
- Executes dropped EXE
PID:723

/bin/zzrmfxwinxqo
/bin/zzrmfxwinxqo -d 610
1⤵
- Deletes itself
PID:726

/bin/fybmosijqbyvo
/bin/fybmosijqbyvo -d 610
1⤵
PID:728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/acbwapwgh

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/aqxujqsgiilbv

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/bbaglkmegu

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/bbivvtc

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/cjmsfnu

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/cyymqejgig

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/dfylavgfnbx

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/dpnyxa

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/dylzlgsfmfzzy

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/fkaszdsix

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/fybmosijqbyvo

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/gztgaupre

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/hcozsjkpba

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/ietenwphkh

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/joowwpxuoj

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/kwgqxzox

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/llowyv

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/lmciktfb

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/lmcyvuukhw

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/mmgtynagq

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/nkpoli

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/nsqztocjnyvesb

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/ohwqcdvrg

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/orogstabtlzli

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/pljfdgc

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/pqfsov

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/prxhtdmc

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/srbgrvpvv

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/untgubwazl

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/uqorkebtvlxo

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/uswopprjgvp

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/vqpulvoohrfxqc

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/vxhdevrx

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/wgivhws

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/wkpksx

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/bin/xqhatcl

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit
/dev/shm/sem.4YwZ72

Filesize
16B

MD5
076933ff9904d1110d896e2c525e39e5

SHA1
4188442577fa77f25820d9b2d01cc446e30684ac

SHA256
4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0

SHA512
6fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34

Download Submit
/etc/cron.hourly/fle.sutkyzlx.sh

Filesize
149B

MD5
a5be7dfe447b7029b5467e8ac7f914a7

SHA1
433f7eb8b9a299b5b196cfbcaf87532aad2095ae

SHA256
418f98c321c7494a90639d5d3043eecce1467ed3590ce3b9f01cd3f2973309aa

SHA512
f1dca2b50f1609b7cbadf1a13bea3f930efb585fe9c3207c0bfda34d4dcaff5006ff0b4fe7734a54cc41035d85dee26c2a66fbc86f534fa98af87702a41b0fd0

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
c5520a5bc418e9ae16b25dc9723871ff

SHA1
3c67b146b37a2b4bbc2be5b2c96840cf0d6eba72

SHA256
d3724e27d491494e3d16bf642e12a44837742630111de83562eee92f54a09069

SHA512
0eeb3d8f804a30a155376f5b31049e2924e2078316e059526986dee0e07747eecbe8f671e26cf650b9ca6bd70a3e982b8e3dd0a499e204bb28d9f77f15686814

Download Submit
/etc/init.d/fle.sutkyzlx

Filesize
348B

MD5
3a9304d269c1978b0044f70ae2cbbf44

SHA1
6e96f7e3c1828a9d451d6289919e3bb8833d9bd5

SHA256
9b8508696c53c18d9126262f9cfb0442a8068b900cbdb5e76669b1a9f8c7128b

SHA512
5003b73ff4d3e9a12f7af0d11e45c6f5ff79febcd81dabefb54733afd4302570f06260c3df6e9d40f82e5c36cf444c353c45c935cd0b5176e409b799fc1dbff2

Download Submit
/tmp/fle.sutkyzlx

Filesize
549KB

MD5
895f7fff165ddfba70b7d718ac3de989

SHA1
2663c2ebb853083f5cf645cdc0cce31c8ace4fba

SHA256
311c93575efd4eeeb9c6674d0ab8de263b72a8fb060d04450daccc78ec095151

SHA512
c4d3a5eea879e69d347e29a60780e2ddc31f0d2a78abc7429b8d2b4306065c34f0ed1a03cd0a74234f5098ef239f745fccb87086c5cdaf9f65383d119e77e617

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads