Extracted

• • Target

    8c8da16a2b9e7c318a9544ff032bddbe

  • Size

    611KB

  • MD5

    8c8da16a2b9e7c318a9544ff032bddbe

  • SHA1

    6a73498e4a7ea07cb6a508552e10f859ebeb9e04

  • SHA256

    2674fcea6abf859f06e6bb629823423c326528a9e5623c8bdf05a370e78bdd4e

  • SHA512

    e14bf4ac5adb60aa1423074b7d79908d484909f211ff439e58ae8b4d9309e106646716975ea7be05c46fe00abb8e524d816d891221aadf1e7af2950b8ea2b645

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrpT6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNNpBVEBl/91h

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1