xorddos | ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73

Analysis

max time kernel
37s
max time network
41s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20230621-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20230621-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-08-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

112
Size

549KB
MD5

f9191bab1e834d4aef3380700639cee9
SHA1

9c20269df6694260a24ac783de2e30d627a6928a
SHA256

ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73
SHA512

3d2758fe2d06183e627b5cc24919c08c84108f2efd7ab0a162029d55537476410d9535d50f3eb059f7153f7482c134284862eea121201f82838aace4b12283b5
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

api.markerbio.com:112

api.enoan2107.com:112

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 28 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_xorddos
behavioral1/files/fstream-5.dat	family_xorddos
behavioral1/files/fstream-11.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos
behavioral1/files/fstream-17.dat	family_xorddos
behavioral1/files/fstream-19.dat	family_xorddos
behavioral1/files/fstream-21.dat	family_xorddos
behavioral1/files/fstream-23.dat	family_xorddos
behavioral1/files/fstream-25.dat	family_xorddos
behavioral1/files/fstream-27.dat	family_xorddos
behavioral1/files/fstream-29.dat	family_xorddos
behavioral1/files/fstream-31.dat	family_xorddos
behavioral1/files/fstream-35.dat	family_xorddos
behavioral1/files/fstream-37.dat	family_xorddos
behavioral1/files/fstream-39.dat	family_xorddos
behavioral1/files/fstream-41.dat	family_xorddos
behavioral1/files/fstream-43.dat	family_xorddos
behavioral1/files/fstream-45.dat	family_xorddos
behavioral1/files/fstream-47.dat	family_xorddos
behavioral1/files/fstream-49.dat	family_xorddos
behavioral1/files/fstream-51.dat	family_xorddos
behavioral1/files/fstream-53.dat	family_xorddos
behavioral1/files/fstream-55.dat	family_xorddos
behavioral1/files/fstream-57.dat	family_xorddos
behavioral1/files/fstream-59.dat	family_xorddos
behavioral1/files/fstream-61.dat	family_xorddos
behavioral1/files/fstream-63.dat	family_xorddos
behavioral1/files/fstream-65.dat	family_xorddos

Deletes itself 27 IoCs

pid	Process
604	wazmkgqk
618	ygruodxbn
621	tokhsjif
624	hhgsiqwgjicgu
627	nzefvm
629	konrmyatupsauq
633	kbjrri
637	Process not Found
639	Process not Found
643	Process not Found
645	Process not Found
649	Process not Found
653	Process not Found
656	Process not Found
659	Process not Found
662	Process not Found
666	Process not Found
670	Process not Found
673	Process not Found
676	Process not Found
678	Process not Found
681	Process not Found
685	Process not Found
688	Process not Found
691	Process not Found
693	Process not Found
699	Process not Found

Executes dropped EXE 27 IoCs

ioc	pid	Process
/bin/wazmkgqk	607	sqmovrbx
/bin/hfdsdcyo	616	hoyfnxvuxl
/bin/rhybqd	619	vdxcrxh
/bin/sqmovrbx	622	fjzjcytluxmope
/bin/xfeyshejla	625	wbydawxmp
/bin/wxxpexq	628	dowafudfxfbwrq
/bin/khvcujx	632	nrynlqbxmddjn
/bin/nwgkbkivuo	635	Process not Found
/bin/hoyfnxvuxl	638	Process not Found
/bin/axyvzu	641	Process not Found
/bin/ygruodxbn	644	Process not Found
/bin/vdxcrxh	648	Process not Found
/bin/uebtqstpqoplv	651	Process not Found
/bin/tokhsjif	654	Process not Found
/bin/fjzjcytluxmope	657	Process not Found
/bin/fxwuktjfhvozf	661	Process not Found
/bin/hhgsiqwgjicgu	665	Process not Found
/bin/wbydawxmp	668	Process not Found
/bin/rwghylgf	671	Process not Found
/bin/nzefvm	674	Process not Found
/bin/dowafudfxfbwrq	677	Process not Found
/bin/konrmyatupsauq	680	Process not Found
/bin/kvcgvhdao	683	Process not Found
/bin/fpxwheiwtakrc	686	Process not Found
/bin/nrynlqbxmddjn	689	Process not Found
/bin/kbjrri	692	Process not Found
/bin/aoywhyjaanntnc	697	Process not Found

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc
File opened for modification	/etc/cron.hourly/kqgkmzaw.sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/kqgkmzaw

Writes file to system bin folder 1 TTPs 29 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/bin/nrynlqbxmddjn
File opened for modification	/bin/kbjrri
File opened for modification	/bin/nwgkbkivuo
File opened for modification	/bin/uebtqstpqoplv
File opened for modification	/bin/kvcgvhdao
File opened for modification	/bin/rwghylgf
File opened for modification	/bin/aoywhyjaanntnc
File opened for modification	/bin/tokhsjif
File opened for modification	/bin/fjzjcytluxmope
File opened for modification	/bin/wbydawxmp
File opened for modification	/bin/rhybqd
File opened for modification	/bin/wxxpexq
File opened for modification	/bin/hoyfnxvuxl
File opened for modification	/bin/konrmyatupsauq
File opened for modification	/bin/wazmkgqk
File opened for modification	/bin/kqgkmzaw
File opened for modification	/bin/kqgkmzaw.sh
File opened for modification	/bin/ygruodxbn
File opened for modification	/bin/fxwuktjfhvozf
File opened for modification	/bin/eddsihbvpnx
File opened for modification	/bin/hhgsiqwgjicgu
File opened for modification	/bin/dowafudfxfbwrq
File opened for modification	/bin/fpxwheiwtakrc
File opened for modification	/bin/hfdsdcyo
File opened for modification	/bin/sqmovrbx
File opened for modification	/bin/khvcujx
File opened for modification	/bin/xfeyshejla
File opened for modification	/bin/axyvzu
File opened for modification	/bin/nzefvm

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 38 IoCs

Reads data from /proc virtual filesystem.

description	ioc
File opened for reading	/proc/262/fd
File opened for reading	/proc/353/fd
File opened for reading	/proc/643/fd
File opened for reading	/proc/693/fd
File opened for reading	/proc/685/fd
File opened for reading	/proc/299/fd
File opened for reading	/proc/359/fd
File opened for reading	/proc/374/fd
File opened for reading	/proc/418/fd
File opened for reading	/proc/639/fd
File opened for reading	/proc/653/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/342/fd
File opened for reading	/proc/351/fd
File opened for reading	/proc/574/fd
File opened for reading	/proc/633/fd
File opened for reading	/proc/691/fd
File opened for reading	/proc/366/fd
File opened for reading	/proc/380/fd
File opened for reading	/proc/419/fd
File opened for reading	/proc/676/fd
File opened for reading	/proc/609/fd
File opened for reading	/proc/673/fd
File opened for reading	/proc/444/fd
File opened for reading	/proc/598/fd
File opened for reading	/proc/637/fd
File opened for reading	/proc/670/fd
File opened for reading	/proc/649/fd
File opened for reading	/proc/666/fd
File opened for reading	/proc/241/fd
File opened for reading	/proc/300/fd
File opened for reading	/proc/349/fd
File opened for reading	/proc/352/fd
File opened for reading	/proc/443/fd
File opened for reading	/proc/645/fd
File opened for reading	/proc/678/fd
File opened for reading	/proc/681/fd
File opened for reading	/proc/688/fd

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc
File opened for modification	/dev/shm/sem.ceahgk
File opened for modification	/dev/shm/sem.48rSgW

/tmp/112
/tmp/112
1⤵
PID:603

/bin/wazmkgqk
/bin/wazmkgqk
1⤵
- Deletes itself
PID:607

/bin/hfdsdcyo
/bin/hfdsdcyo -d 608
1⤵
PID:616

/bin/rhybqd
/bin/rhybqd -d 608
1⤵
PID:619

/bin/sqmovrbx
/bin/sqmovrbx -d 608
1⤵
- Executes dropped EXE
PID:622

/bin/xfeyshejla
/bin/xfeyshejla -d 608
1⤵
PID:625

/bin/wxxpexq
/bin/wxxpexq -d 608
1⤵
PID:628

/bin/khvcujx
/bin/khvcujx -d 608
1⤵
PID:632

/bin/nwgkbkivuo
/bin/nwgkbkivuo -d 608
1⤵
PID:635

/bin/hoyfnxvuxl
/bin/hoyfnxvuxl -d 608
1⤵
- Executes dropped EXE
PID:638

/bin/axyvzu
/bin/axyvzu -d 608
1⤵
PID:641

/bin/ygruodxbn
/bin/ygruodxbn -d 608
1⤵
- Deletes itself
PID:644

/bin/vdxcrxh
/bin/vdxcrxh -d 608
1⤵
- Executes dropped EXE
PID:648

/bin/uebtqstpqoplv
/bin/uebtqstpqoplv -d 608
1⤵
PID:651

/bin/tokhsjif
/bin/tokhsjif -d 608
1⤵
- Deletes itself
PID:654

/bin/fjzjcytluxmope
/bin/fjzjcytluxmope -d 608
1⤵
- Executes dropped EXE
PID:657

/bin/fxwuktjfhvozf
/bin/fxwuktjfhvozf -d 608
1⤵
PID:661

/bin/hhgsiqwgjicgu
/bin/hhgsiqwgjicgu -d 608
1⤵
- Deletes itself
PID:665

/bin/wbydawxmp
/bin/wbydawxmp -d 608
1⤵
- Executes dropped EXE
PID:668

/bin/rwghylgf
/bin/rwghylgf -d 608
1⤵
PID:671

/bin/nzefvm
/bin/nzefvm -d 608
1⤵
- Deletes itself
PID:674

/bin/dowafudfxfbwrq
/bin/dowafudfxfbwrq -d 608
1⤵
- Executes dropped EXE
PID:677

/bin/konrmyatupsauq
/bin/konrmyatupsauq -d 608
1⤵
- Deletes itself
PID:680

/bin/kvcgvhdao
/bin/kvcgvhdao -d 608
1⤵
PID:683

/bin/fpxwheiwtakrc
/bin/fpxwheiwtakrc -d 608
1⤵
PID:686

/bin/nrynlqbxmddjn
/bin/nrynlqbxmddjn -d 608
1⤵
- Executes dropped EXE
PID:689

/bin/kbjrri
/bin/kbjrri -d 608
1⤵
- Deletes itself
PID:692

/bin/aoywhyjaanntnc
/bin/aoywhyjaanntnc -d 608
1⤵
PID:697

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/aoywhyjaanntnc

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/axyvzu

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/dowafudfxfbwrq

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/eddsihbvpnx

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/fjzjcytluxmope

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/fpxwheiwtakrc

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/fxwuktjfhvozf

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/hfdsdcyo

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/hhgsiqwgjicgu

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/hoyfnxvuxl

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/kbjrri

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/khvcujx

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/konrmyatupsauq

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/kqgkmzaw

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/kvcgvhdao

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/nrynlqbxmddjn

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/nwgkbkivuo

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/nzefvm

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/rhybqd

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/rwghylgf

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/sqmovrbx

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/tokhsjif

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/uebtqstpqoplv

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/wazmkgqk

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/wbydawxmp

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/wxxpexq

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/xfeyshejla

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/bin/ygruodxbn

Filesize
549KB

MD5
59add66b44ea81d8fc4d35776b2796d0

SHA1
832f20c5cb4d8763e11d1e84ab0af5316f8ea389

SHA256
cb3e3b613d9cbb3a05129af514d1bcf7b282eadcbbe1356eb566e576f445b6bd

SHA512
7252ee25d7070faea715809d7d5dd67682963604673adc8619f41ebe8a548cd97416e69e86e3020f8326aae5979fcb1133531f671f8f7813e304655673ad620f

Download Submit
/dev/shm/sem.48rSgW

Filesize
16B

MD5
076933ff9904d1110d896e2c525e39e5

SHA1
4188442577fa77f25820d9b2d01cc446e30684ac

SHA256
4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0

SHA512
6fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34

Download Submit
/etc/cron.hourly/kqgkmzaw.sh

Filesize
145B

MD5
e631881986e31a06d50f0412d5201637

SHA1
a750fbdd90bdaec5ca1f1cc4c3094c206c382ac7

SHA256
ca40f60af804eb41216ab2d76296920a875f7671d27cce2411eccab24aacb178

SHA512
06cc1880fd3d40a90ab3670ea37b69b21ade70ac55e948c805a6d73e5acba2f6dfd9ea340231d1605bd9d79e7293cb56710bc3cb596cbfaa5bb89001e15367f9

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
7f1822b773c640316411f015b3bfce81

SHA1
ffbf5e91f0c6586f8e700a1cbaec61a17fc22f35

SHA256
bc26c802026fb356594bc9ee2fdfa820f52f35070505baeb815c15cb238e2ea5

SHA512
b1aa0d67eca9d26fcf90f0af7b883d642d7c4aa408fc6d5fc4383904ea92d4fb82613b87b23ace3847df9c5d19cdc6608c08d8d21e649b27711f119fd2cd3935

Download Submit
/etc/init.d/kqgkmzaw

Filesize
328B

MD5
6d11033dfc6e6100f075d467360688cf

SHA1
4c14abd5bc83ed7c88b8f8bd141a58aaeff46c92

SHA256
50694ab81ad8b43c5a825250a4d464743f46fd277992de3e4211b81711058132

SHA512
9710d0e965849f94faf238266d5aecfc55cc2d978574265debf1d360a93ca074681721ebfbd0337beb102278cd7ad44ff29883733f0e9666c03454b0ef45443a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads