Analysis
-
max time kernel
49s -
max time network
39s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-09-2023 22:18
Behavioral task
behavioral1
Sample
9283b6d62d082b766334bb320a159ef69ac45bcdaf62d57a9e322a685e0b025d.exe
Resource
ubuntu1804-amd64-20230831-en
ubuntu-18.04-amd64
General
-
Target
9283b6d62d082b766334bb320a159ef69ac45bcdaf62d57a9e322a685e0b025d.exe
-
Size
535KB
-
MD5
3d862e6f731cf85254cc6ccaa726e4b7
-
SHA1
ea164000f476d2e4eae5fc0874ebcbb62a3c9d66
-
SHA256
9283b6d62d082b766334bb320a159ef69ac45bcdaf62d57a9e322a685e0b025d
-
SHA512
c237d6b49668724e6cd9553dbe002b7278c16c1553db7cca2d3950d77b81a0858b08810e0d38e9161d3cab8f79eae0477407960dd479a7c4ecb6a6850475a2d1
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzg66ySjQn36EojD:/fUywKQ7Fb1pNL/p5gfjQn36EuD
Malware Config
Extracted
xorddos
http://aa.hostasa.org/config.rar
ppp.gggatat456.com:1520
ppp.xxxatat456.com:1520
www1.gggatat456.com:1520
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 19 IoCs
Processes:
resource yara_rule behavioral1/files/fstream-5.dat family_xorddos behavioral1/files/fstream-7.dat family_xorddos behavioral1/files/fstream-8.dat family_xorddos behavioral1/files/fstream-9.dat family_xorddos behavioral1/files/fstream-10.dat family_xorddos behavioral1/files/fstream-11.dat family_xorddos behavioral1/files/fstream-12.dat family_xorddos behavioral1/files/fstream-13.dat family_xorddos behavioral1/files/fstream-14.dat family_xorddos behavioral1/files/fstream-15.dat family_xorddos behavioral1/files/fstream-16.dat family_xorddos behavioral1/files/fstream-17.dat family_xorddos behavioral1/files/fstream-18.dat family_xorddos behavioral1/files/fstream-19.dat family_xorddos behavioral1/files/fstream-20.dat family_xorddos behavioral1/files/fstream-21.dat family_xorddos behavioral1/files/fstream-22.dat family_xorddos behavioral1/files/fstream-23.dat family_xorddos behavioral1/files/fstream-24.dat family_xorddos -
Executes dropped EXE 26 IoCs
Processes:
yvnsrraympyvnsrraympyvnsrraympyvnsrraympyvnsrraympaywudfbackaywudfbackaywudfbackaywudfbackaywudfbacksgkjprnoamsgkjprnoamsgkjprnoamsgkjprnoamsgkjprnoamnbrljpkfecnbrljpkfecnbrljpkfecnbrljpkfecnbrljpkfecybiggynifhybiggynifhybiggynifhybiggynifhybiggynifhekjwatqaqkioc pid Process /usr/bin/yvnsrraymp 630 yvnsrraymp /usr/bin/yvnsrraymp 633 yvnsrraymp /usr/bin/yvnsrraymp 636 yvnsrraymp /usr/bin/yvnsrraymp 639 yvnsrraymp /usr/bin/yvnsrraymp 642 yvnsrraymp /usr/bin/aywudfback 645 aywudfback /usr/bin/aywudfback 648 aywudfback /usr/bin/aywudfback 651 aywudfback /usr/bin/aywudfback 654 aywudfback /usr/bin/aywudfback 657 aywudfback /usr/bin/sgkjprnoam 660 sgkjprnoam /usr/bin/sgkjprnoam 663 sgkjprnoam /usr/bin/sgkjprnoam 666 sgkjprnoam /usr/bin/sgkjprnoam 669 sgkjprnoam /usr/bin/sgkjprnoam 672 sgkjprnoam /usr/bin/nbrljpkfec 676 nbrljpkfec /usr/bin/nbrljpkfec 679 nbrljpkfec /usr/bin/nbrljpkfec 682 nbrljpkfec /usr/bin/nbrljpkfec 685 nbrljpkfec /usr/bin/nbrljpkfec 688 nbrljpkfec /usr/bin/ybiggynifh 691 ybiggynifh /usr/bin/ybiggynifh 694 ybiggynifh /usr/bin/ybiggynifh 697 ybiggynifh /usr/bin/ybiggynifh 700 ybiggynifh /usr/bin/ybiggynifh 703 ybiggynifh /usr/bin/ekjwatqaqk 708 ekjwatqaqk -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
description ioc File opened for reading /proc/cpuinfo -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
shdescription ioc Process File opened for modification /etc/cron.hourly/gcc.sh