Analysis
-
max time kernel
95s -
max time network
44s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26-10-2023 18:30
Behavioral task
behavioral1
Sample
1.elf
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
General
-
Target
1.elf
-
Size
611KB
-
MD5
ff1a3683a5ad87f88858e92fbcf1ae57
-
SHA1
ce220486f7d4723406582f8496e8483bcc546beb
-
SHA256
d2d0a9fc3491d0689529b251d666f36b739acfbf4f7fe8190b6ebabb887b7154
-
SHA512
9039533b03c9cbd3a31d1f232080a7c6296a74e36cad46f31678478451b521d0c19cc5cc25cf88bccc7c4ed006c2f99470595cdd34cf3814ee4509bb80d5eebd
-
SSDEEP
12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrryT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNyBVEBl/91h
Malware Config
Extracted
xorddos
http://www1.gggatat456.com/dd.rar
ppp.gggatat456.com:1525
ppp.xxxatat456.com:1525
p5.dddgata789.com:1525
p5.lpjulidny7.com:1525
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 19 IoCs
Processes:
resource yara_rule behavioral1/files/fstream-5.dat family_xorddos behavioral1/files/fstream-7.dat family_xorddos behavioral1/files/fstream-8.dat family_xorddos behavioral1/files/fstream-9.dat family_xorddos behavioral1/files/fstream-10.dat family_xorddos behavioral1/files/fstream-11.dat family_xorddos behavioral1/files/fstream-12.dat family_xorddos behavioral1/files/fstream-13.dat family_xorddos behavioral1/files/fstream-14.dat family_xorddos behavioral1/files/fstream-15.dat family_xorddos behavioral1/files/fstream-16.dat family_xorddos behavioral1/files/fstream-17.dat family_xorddos behavioral1/files/fstream-18.dat family_xorddos behavioral1/files/fstream-19.dat family_xorddos behavioral1/files/fstream-20.dat family_xorddos behavioral1/files/fstream-21.dat family_xorddos behavioral1/files/fstream-22.dat family_xorddos behavioral1/files/fstream-23.dat family_xorddos behavioral1/files/fstream-24.dat family_xorddos -
Executes dropped EXE 26 IoCs
Processes:
rfkzjqxxafrfkzjqxxafrfkzjqxxafrfkzjqxxafrfkzjqxxafgeunuwzkotgeunuwzkotgeunuwzkotgeunuwzkotgeunuwzkotsmwxprxyyzsmwxprxyyzsmwxprxyyzsmwxprxyyzsmwxprxyyzuejqpuvkbbuejqpuvkbbuejqpuvkbbuejqpuvkbbuejqpuvkbbdnsiwkdgrvdnsiwkdgrvdnsiwkdgrvdnsiwkdgrvdnsiwkdgrvyloniaofeaioc pid Process /usr/bin/rfkzjqxxaf 609 rfkzjqxxaf /usr/bin/rfkzjqxxaf 627 rfkzjqxxaf /usr/bin/rfkzjqxxaf 630 rfkzjqxxaf /usr/bin/rfkzjqxxaf 633 rfkzjqxxaf /usr/bin/rfkzjqxxaf 640 rfkzjqxxaf /usr/bin/geunuwzkot 643 geunuwzkot /usr/bin/geunuwzkot 646 geunuwzkot /usr/bin/geunuwzkot 649 geunuwzkot /usr/bin/geunuwzkot 652 geunuwzkot /usr/bin/geunuwzkot 655 geunuwzkot /usr/bin/smwxprxyyz 658 smwxprxyyz /usr/bin/smwxprxyyz 661 smwxprxyyz /usr/bin/smwxprxyyz 664 smwxprxyyz /usr/bin/smwxprxyyz 667 smwxprxyyz /usr/bin/smwxprxyyz 670 smwxprxyyz /usr/bin/uejqpuvkbb 673 uejqpuvkbb /usr/bin/uejqpuvkbb 676 uejqpuvkbb /usr/bin/uejqpuvkbb 679 uejqpuvkbb /usr/bin/uejqpuvkbb 682 uejqpuvkbb /usr/bin/uejqpuvkbb 685 uejqpuvkbb /usr/bin/dnsiwkdgrv 688 dnsiwkdgrv /usr/bin/dnsiwkdgrv 691 dnsiwkdgrv /usr/bin/dnsiwkdgrv 694 dnsiwkdgrv /usr/bin/dnsiwkdgrv 697 dnsiwkdgrv /usr/bin/dnsiwkdgrv 700 dnsiwkdgrv /usr/bin/yloniaofea 705 yloniaofea -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
description ioc File opened for reading /proc/cpuinfo -
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
shdescription ioc Process File opened for modification /etc/crontab sh File opened for modification /etc/cron.hourly/gcc.sh