Extracted

• • Target

    d2d0a9fc3491d0689529b251d666f36b739acfbf4f7fe8190b6ebabb887b7154.elf

  • Size

    611KB

  • MD5

    ff1a3683a5ad87f88858e92fbcf1ae57

  • SHA1

    ce220486f7d4723406582f8496e8483bcc546beb

  • SHA256

    d2d0a9fc3491d0689529b251d666f36b739acfbf4f7fe8190b6ebabb887b7154

  • SHA512

    9039533b03c9cbd3a31d1f232080a7c6296a74e36cad46f31678478451b521d0c19cc5cc25cf88bccc7c4ed006c2f99470595cdd34cf3814ee4509bb80d5eebd

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrryT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNyBVEBl/91h

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Checks CPU configuration

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1