Overview

overview

10

Static

static

10

55a111f462...f5dbdc

ubuntu-18.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    55a111f4625348cffd6d910e49f5dbdc
  • Size 611KB
  • Sample231219-29fd5acfbp
  • SHA256 86a8a2107448d28214e43a86e1367feec9e7f45201a3013c57bc200bf760e1ee
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorddosbotnetdownloaderlinuxpersistence

Malware Config

Extracted

Family

  • xorddos

C2

  • http://aa.finance1num.org/config.rar

  • cdn.netflix2cdn.com:80

  • cdn.finance1num.com:80

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      55a111f4625348cffd6d910e49f5dbdc
    • Size 611KB
    • SHA256 86a8a2107448d28214e43a86e1367feec9e7f45201a3013c57bc200bf760e1ee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xorddosbotnetdownloaderpersistence

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Deletes itself

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks