Extracted

• • Target

    79a7792955c2e7137c68bec4803ce65b

  • Size

    611KB

  • MD5

    79a7792955c2e7137c68bec4803ce65b

  • SHA1

    43763f2832b4329f2c3f8aca4fba6aa3522351f8

  • SHA256

    fa0a5c652d3a69d21ce4a5eb65f95537d880fd41190d73eaffc38aa070047108

  • SHA512

    360fc13ede6a35ae5fd489a48a760d99fc3c027000cf42da3c6f6a6cb9d0834692395547275751fe568cf0290de45a6d1c7d12c04a36297d17ce237da9aad3e3

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrBT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNBBVEBl/91h

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Checks CPU configuration

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1