Extracted

• • Target
    d2d0a9fc3491d0689529b251d666f36b739acfbf4f7fe8190b6ebabb887b7154.elf
  • Size 611KB
  • SHA256 d2d0a9fc3491d0689529b251d666f36b739acfbf4f7fe8190b6ebabb887b7154
  • MD5 ff1a3683a5ad87f88858e92fbcf1ae57
  • SHA1 ce220486f7d4723406582f8496e8483bcc546beb
  • SHA512 9039533b03c9cbd3a31d1f232080a7c6296a74e36cad46f31678478451b521d0c19cc5cc25cf88bccc7c4ed006c2f99470595cdd34cf3814ee4509bb80d5eebd
  • SSDEEP 12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrryT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNyBVEBl/91h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Checks CPU configuration

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1