xorddos | 4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853

Analysis

max time kernel
54s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01-07-2023 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23s.exe
Size

549KB
MD5

63d6cd74a7cd01bf3a3921c36e90237f
SHA1

f697783da228c7787cf1c6a67a10a8c065d6aaa7
SHA256

4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
SHA512

51b1aef53c8277b8700630b144f15c9a41df358a43d71ef0b9352bbdf71c8777774f1ef1e361c8c95930143b54fcde590885242df3da60dce5b1a1d3761e2db3
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

www.imagetw0.com:889

www.myserv012.com:889

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 33 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_xorddos
behavioral1/files/fstream-5.dat	family_xorddos
behavioral1/files/fstream-12.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos
behavioral1/files/fstream-17.dat	family_xorddos
behavioral1/files/fstream-19.dat	family_xorddos
behavioral1/files/fstream-21.dat	family_xorddos
behavioral1/files/fstream-23.dat	family_xorddos
behavioral1/files/fstream-25.dat	family_xorddos
behavioral1/files/fstream-27.dat	family_xorddos
behavioral1/files/fstream-29.dat	family_xorddos
behavioral1/files/fstream-31.dat	family_xorddos
behavioral1/files/fstream-33.dat	family_xorddos
behavioral1/files/fstream-35.dat	family_xorddos
behavioral1/files/fstream-37.dat	family_xorddos
behavioral1/files/fstream-39.dat	family_xorddos
behavioral1/files/fstream-41.dat	family_xorddos
behavioral1/files/fstream-43.dat	family_xorddos
behavioral1/files/fstream-45.dat	family_xorddos
behavioral1/files/fstream-47.dat	family_xorddos
behavioral1/files/fstream-53.dat	family_xorddos
behavioral1/files/fstream-55.dat	family_xorddos
behavioral1/files/fstream-57.dat	family_xorddos
behavioral1/files/fstream-59.dat	family_xorddos
behavioral1/files/fstream-61.dat	family_xorddos
behavioral1/files/fstream-73.dat	family_xorddos
behavioral1/files/fstream-75.dat	family_xorddos
behavioral1/files/fstream-77.dat	family_xorddos
behavioral1/files/fstream-79.dat	family_xorddos
behavioral1/files/fstream-81.dat	family_xorddos
behavioral1/files/fstream-83.dat	family_xorddos
behavioral1/files/fstream-85.dat	family_xorddos
behavioral1/files/fstream-87.dat	family_xorddos

Deletes itself 27 IoCs

pid	Process
598	cpdocx
612	sjtxsjaam
615	smsmknvmnij
618	srovjswbs
621	uyfkzfypqcoa
623	zodjipe
627	umuqgqzjkdbeeg
630	Process not Found
633	Process not Found
636	Process not Found
638	Process not Found
642	Process not Found
645	Process not Found
647	Process not Found
650	Process not Found
653	Process not Found
656	Process not Found
660	Process not Found
671	Process not Found
675	Process not Found
678	Process not Found
680	Process not Found
703	Process not Found
707	Process not Found
709	Process not Found
713	Process not Found
719	Process not Found

Executes dropped EXE 27 IoCs

ioc	pid	Process
/bin/cpdocx	601	ilukeawsbgfajq
/bin/muyhvuxxxsy	610	cibvldnzbvwuge
/bin/xhlsnwtruqrtm	613	jjnqpm
/bin/ilukeawsbgfajq	616	avmvgxkwowgvys
/bin/lcdfrb	619	nrlbli
/bin/xobrcqb	622	xkwrlzlck
/bin/lsdaslvixrjgdl	625	afegbw
/bin/hnxrfbqjshd	628	plastpchpwiwx
/bin/cibvldnzbvwuge	631	Process not Found
/bin/toqbdou	634	Process not Found
/bin/sjtxsjaam	637	Process not Found
/bin/jjnqpm	640	Process not Found
/bin/fcmksgs	643	Process not Found
/bin/smsmknvmnij	646	Process not Found
/bin/avmvgxkwowgvys	649	Process not Found
/bin/rbaatmvfyidkxn	652	Process not Found
/bin/srovjswbs	655	Process not Found
/bin/nrlbli	658	Process not Found
/bin/uzbsrjbveoitlu	670	Process not Found
/bin/uyfkzfypqcoa	673	Process not Found
/bin/xkwrlzlck	676	Process not Found
/bin/zodjipe	679	Process not Found
/bin/snedxhqvswhcse	702	Process not Found
/bin/afegbw	705	Process not Found
/bin/piukndizxxd	708	Process not Found
/bin/umuqgqzjkdbeeg	711	Process not Found
/bin/plastpchpwiwx	717	Process not Found

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114
Destination IP	114.114.114.114

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task

T1053

description	ioc
File opened for modification	/etc/cron.hourly/xcodpc.sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/xcodpc

Writes file to system bin folder 1 TTPs 34 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/bin/xobrcqb
File opened for modification	/bin/cibvldnzbvwuge
File opened for modification	/bin/srovjswbs
File opened for modification	/bin/nrlbli
File opened for modification	/bin/ehukzolrxfwuyo
File opened for modification	/bin/piukndizxxd
File opened for modification	/bin/hfzpzm
File opened for modification	/bin/xhlsnwtruqrtm
File opened for modification	/bin/toqbdou
File opened for modification	/bin/zodjipe
File opened for modification	/bin/umuqgqzjkdbeeg
File opened for modification	/bin/sgtorztysgyii
File opened for modification	/bin/hnxrfbqjshd
File opened for modification	/bin/ucoevrsfg
File opened for modification	/bin/afegbw
File opened for modification	/bin/cpdocx
File opened for modification	/bin/rbaatmvfyidkxn
File opened for modification	/bin/sjtxsjaam
File opened for modification	/bin/xcodpc.sh
File opened for modification	/bin/muyhvuxxxsy
File opened for modification	/bin/lcdfrb
File opened for modification	/bin/smsmknvmnij
File opened for modification	/bin/avmvgxkwowgvys
File opened for modification	/bin/uyfkzfypqcoa
File opened for modification	/bin/plastpchpwiwx
File opened for modification	/bin/xcodpc
File opened for modification	/bin/jjnqpm
File opened for modification	/bin/fcmksgs
File opened for modification	/bin/lsdaslvixrjgdl
File opened for modification	/bin/uzbsrjbveoitlu
File opened for modification	/bin/xkwrlzlck
File opened for modification	/bin/leoxdt
File opened for modification	/bin/snedxhqvswhcse
File opened for modification	/bin/ilukeawsbgfajq

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 51 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/460/fd
File opened for reading	/proc/633/fd
File opened for reading	/proc/703/fd
File opened for reading	/proc/713/fd
File opened for reading	/proc/352/fd
File opened for reading	/proc/383/fd
File opened for reading	/proc/389/fd
File opened for reading	/proc/422/fd
File opened for reading	/proc/630/fd
File opened for reading	/proc/636/fd
File opened for reading	/proc/638/fd
File opened for reading	/proc/653/fd
File opened for reading	/proc/665/fd
File opened for reading	/proc/668/fd
File opened for reading	/proc/678/fd
File opened for reading	/proc/687/fd
File opened for reading	/proc/250/fd
File opened for reading	/proc/350/fd
File opened for reading	/proc/355/fd
File opened for reading	/proc/357/fd
File opened for reading	/proc/382/fd
File opened for reading	/proc/627/fd
File opened for reading	/proc/671/fd
File opened for reading	/proc/683/fd
File opened for reading	/proc/709/fd
File opened for reading	/proc/262/fd
File opened for reading	/proc/660/fd
File opened for reading	/proc/692/fd
File opened for reading	/proc/707/fd
File opened for reading	/proc/331/fd
File opened for reading	/proc/592/fd
File opened for reading	/proc/650/fd
File opened for reading	/proc/695/fd
File opened for reading	/proc/565/fd
File opened for reading	/proc/647/fd
File opened for reading	/proc/698/fd
File opened for reading	/proc/333/fd
File opened for reading	/proc/366/fd
File opened for reading	/proc/424/fd
File opened for reading	/proc/642/fd
File opened for reading	/proc/645/fd
File opened for reading	/proc/680/fd
File opened for reading	/proc/715/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/261/fd
File opened for reading	/proc/358/fd
File opened for reading	/proc/606/fd
File opened for reading	/proc/656/fd
File opened for reading	/proc/662/fd
File opened for reading	/proc/675/fd
File opened for reading	/proc/690/fd

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc
File opened for modification	/dev/shm/sem.bptefy
File opened for modification	/dev/shm/sem.Bs7uzM

/tmp/23s.exe
/tmp/23s.exe
1⤵
PID:597

/bin/cpdocx
/bin/cpdocx
1⤵
- Deletes itself
PID:601

/bin/muyhvuxxxsy
/bin/muyhvuxxxsy -d 602
1⤵
PID:610

/bin/xhlsnwtruqrtm
/bin/xhlsnwtruqrtm -d 602
1⤵
PID:613

/bin/ilukeawsbgfajq
/bin/ilukeawsbgfajq -d 602
1⤵
- Executes dropped EXE
PID:616

/bin/lcdfrb
/bin/lcdfrb -d 602
1⤵
PID:619

/bin/xobrcqb
/bin/xobrcqb -d 602
1⤵
PID:622

/bin/lsdaslvixrjgdl
/bin/lsdaslvixrjgdl -d 602
1⤵
PID:625

/bin/hnxrfbqjshd
/bin/hnxrfbqjshd -d 602
1⤵
PID:628

/bin/cibvldnzbvwuge
/bin/cibvldnzbvwuge -d 602
1⤵
- Executes dropped EXE
PID:631

/bin/toqbdou
/bin/toqbdou -d 602
1⤵
PID:634

/bin/sjtxsjaam
/bin/sjtxsjaam -d 602
1⤵
- Deletes itself
PID:637

/bin/jjnqpm
/bin/jjnqpm -d 602
1⤵
- Executes dropped EXE
PID:640

/bin/fcmksgs
/bin/fcmksgs -d 602
1⤵
PID:643

/bin/smsmknvmnij
/bin/smsmknvmnij -d 602
1⤵
- Deletes itself
PID:646

/bin/avmvgxkwowgvys
/bin/avmvgxkwowgvys -d 602
1⤵
- Executes dropped EXE
PID:649

/bin/rbaatmvfyidkxn
/bin/rbaatmvfyidkxn -d 602
1⤵
PID:652

/bin/srovjswbs
/bin/srovjswbs -d 602
1⤵
- Deletes itself
PID:655

/bin/nrlbli
/bin/nrlbli -d 602
1⤵
- Executes dropped EXE
PID:658

/bin/uzbsrjbveoitlu
/bin/uzbsrjbveoitlu -d 602
1⤵
PID:670

/bin/uyfkzfypqcoa
/bin/uyfkzfypqcoa -d 602
1⤵
- Deletes itself
PID:673

/bin/xkwrlzlck
/bin/xkwrlzlck -d 602
1⤵
- Executes dropped EXE
PID:676

/bin/zodjipe
/bin/zodjipe -d 602
1⤵
- Deletes itself
PID:679

/bin/snedxhqvswhcse
/bin/snedxhqvswhcse -d 602
1⤵
PID:702

/bin/afegbw
/bin/afegbw -d 602
1⤵
- Executes dropped EXE
PID:705

/bin/piukndizxxd
/bin/piukndizxxd -d 602
1⤵
PID:708

/bin/umuqgqzjkdbeeg
/bin/umuqgqzjkdbeeg -d 602
1⤵
- Deletes itself
PID:711

/bin/plastpchpwiwx
/bin/plastpchpwiwx -d 602
1⤵
- Executes dropped EXE
PID:717

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/afegbw

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/avmvgxkwowgvys

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/cibvldnzbvwuge

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/cpdocx

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/ehukzolrxfwuyo

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/fcmksgs

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/hfzpzm

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/hnxrfbqjshd

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/ilukeawsbgfajq

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/jjnqpm

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/lcdfrb

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/leoxdt

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/lsdaslvixrjgdl

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/muyhvuxxxsy

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/nrlbli

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/piukndizxxd

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/plastpchpwiwx

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/rbaatmvfyidkxn

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/sgtorztysgyii

Filesize
4KB

MD5
3e88818ab86fecb3e27e086181f3def3

SHA1
db2f7722a869bbd42b1e286256ce5ce220659453

SHA256
52d0b5ff6f6609558e016ce118c869c91c627a6741929ea833aba06843aa6d52

SHA512
4c09cd08d521671a31aaecb846a735c7832a67cbbc2fc08cbf9516e9697b253643ce2545fc13f6b85df5694ae4f847e900b888767062fd172a8cfa4111ca010d

Download Submit
/bin/sjtxsjaam

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/smsmknvmnij

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/snedxhqvswhcse

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/srovjswbs

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/toqbdou

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/ucoevrsfg

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/umuqgqzjkdbeeg

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/uyfkzfypqcoa

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/uzbsrjbveoitlu

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/xcodpc

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/xhlsnwtruqrtm

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/xkwrlzlck

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/xobrcqb

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/bin/zodjipe

Filesize
549KB

MD5
06e15eedce3c40b19286f2458368f24e

SHA1
166bec7e4157224c98820a0586303146f9bb09e3

SHA256
059c016ebbe4d9f3ad6f6326c55329918c02abc5f650d232b9c2a4ad3799f38f

SHA512
300c044248a4f902818838f45d26d0faeb48895a52f29867c4b758f846ed16476233e95f6ee840cf56c03506790850a5afd98bf0f27f0a8ecddb75633b79a059

Download Submit
/dev/shm/sem.Bs7uzM

Filesize
16B

MD5
076933ff9904d1110d896e2c525e39e5

SHA1
4188442577fa77f25820d9b2d01cc446e30684ac

SHA256
4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0

SHA512
6fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34

Download Submit
/etc/cron.hourly/xcodpc.sh

Filesize
143B

MD5
db688be6ae36394205b13235fd0e3732

SHA1
242ee8f9a8263345224067b06fcbb62ae2e5bfb2

SHA256
6c8c8ce299406c066e89976066a1ea3a42febec97d49cc47ccc9d8d78b735748

SHA512
a2cc3c17edf9e3fdd60299eba75f25d9572ece1d1bedd7ae7ab1eb42115f6c18e1b12c617369cc112ddba925e952ea92910eb4830b90e5b89233a2845e26c578

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
0a9ee3727e3bcdcb6436e887cf22bdbd

SHA1
e31a4f356dce6ce54192dfcbd53bfef7901eaa83

SHA256
a03b5b1f79e50d27cc64cca318b8e1745f552b452a2a8e087a339a75839c97f4

SHA512
ba6426b36206dff0ea4000290b2557d1ba3a3e6e3b9dce63bac2a8fffbb61edaabe55d92a5b3aee46a1cd0ec4833391c505041a932bbf0b2a3ae9ecb067a027b

Download Submit
/etc/init.d/xcodpc

Filesize
318B

MD5
79dcaa4a8d5918cbbd53ed5da9d736ba

SHA1
8ed8ac173c1e0c67d7ee1531e7e8059a0c4d71e4

SHA256
21078d9010c5782f0732f8b9ba7efdc969fe6ded76d0eb4c1aeb140d02975165

SHA512
bb18ff8cd0a549b10cc4579bbc20b6da0028d10b31f0a0610c61ff93341fec298591c86c19b948bc1c4b7d99373e7c57f8c7c565a706fe42eb2dcd35923a2c4b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads