Extracted

• • Target

    af9bd7aaca9749816ef700d9dccdfe8e

  • Size

    647KB

  • MD5

    af9bd7aaca9749816ef700d9dccdfe8e

  • SHA1

    d636b30b14b80378808735a8b5002824ba94d005

  • SHA256

    5837609d4cfa0c9db43136ea748ff39ca90591966611b2ad1ae48938844f775b

  • SHA512

    830eba48452b8d6b3d5aa5aaac6d9e3f5c2c6440c4bf636795906e903eaa3dbc0f8d88f81760716f2a1bb3f19074e23b2a70a4f1948d396d110899ca384c9a2e

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1TonDp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mD6wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1