Extracted

• • Target

    7d44757d809641646e02ab76ed93ede8

  • Size

    647KB

  • MD5

    7d44757d809641646e02ab76ed93ede8

  • SHA1

    332f38022f433a472dc5aa6683c9b9ccccf46e0d

  • SHA256

    0972688711161e347d08ce1c931eb41904fc6f4e4764548e1f14da132a0d1b5d

  • SHA512

    ecf553a88eb61f122f8f8d5afc1a6331189ca15af0179ed81e38d7c95aaa0eaf1e7953eabfeb142a539465e6c2dee24d984dc6a03309a15b6c19326dcb005b77

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1TonHp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mH6wvnDWXMN

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks CPU configuration

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1