Overview

overview

10

Static

static

10

3a8a11b60f...ba.elf

ubuntu-18.04-amd64

10

Resubmissions

10/01/2024, 13:46

240110-q2yd7agegk

02/11/2023, 08:28

231102-kdepaahe7v10

02/11/2023, 08:25

231102-kbbjvabd8710

02/11/2023, 08:23

231102-kaly7ahe3110

02/11/2023, 08:23

231102-j99nvsbd76

31/10/2023, 10:42

231031-mr4lnsfe3y10

Sharing

Copy URL Twitter E-mail

General

  • Target
    85682d3effdb2d559fd84df491e9461a.bin
  • Size 280KB
  • Sample231102-kaly7ahe31
  • SHA256 8e996db5961bec2587b92b94e946d2b58230187426757f199ca99b59074d6391
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddosbotnetdownloaderlinuxpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • http://www1.gggatat456.com/dd.rar

  • ppp.gggatat456.com:1525

  • ppp.xxxatat456.com:1525

  • p5.dddgata789.com:1525

  • p5.lpjulidny7.com:1525

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      3a8a11b60fd8e2f93d29fb46cdda68fd404b06147a7c717d3619b088e39875ba.elf
    • Size 611KB
    • SHA256 3a8a11b60fd8e2f93d29fb46cdda68fd404b06147a7c717d3619b088e39875ba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xorddosbotnetdownloaderpersistence

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks