Extracted

• • Target

    2fd1d1a39b6c6a58fb55967d3c23dfac

  • Size

    544KB

  • MD5

    2fd1d1a39b6c6a58fb55967d3c23dfac

  • SHA1

    9aafe38a1eb05565479bf6cf30ea32b4ef51bbeb

  • SHA256

    47bf33fd353be8b334f188c839dac4a6a1b71fe220a1c98122628cc5fddabe3d

  • SHA512

    99063a0f2cbf0473821ee0bc242f6edfc676f4e7b9ea61f7a1a9c84c5df30a6b42afb8a3e8e8e2c8380bfe98b261dc5100710e793a7162ce5eb17fc02770948b

  • SSDEEP

    12288:JbinNy0Y1nvEtXBx6DkkJmAGyPexU279WnjVZ6ySWK:1iNy0evmxvkJmApPexUm9cVE

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Writes file to system bin folder

  behavioral1