Extracted

• • Target

    861af674fbaba4f5c58d964a4d891abf

  • Size

    647KB

  • MD5

    861af674fbaba4f5c58d964a4d891abf

  • SHA1

    a879746df5e4999027d52a36e1cc19ce6a83320a

  • SHA256

    0aac76180e779723716e014c5125aaa40a6576dc58da0308e7b397b2eb3d4137

  • SHA512

    e9beb8d3522ab751afb6a88e53ee72f6940f98df5a6c2acc9b3e89df9da15ff6dee247832e0e51d46dfb6ef9d24aa6fc06082b82c349bd1dab8e60a8ec8153c7

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1TonDp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mD6wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1