Extracted

• • Target

    cab83472f26ffcc4bcf0053f703d44ca

  • Size

    247KB

  • MD5

    cab83472f26ffcc4bcf0053f703d44ca

  • SHA1

    49a6df3d5ff918b1499dc8541d62479ecdc13114

  • SHA256

    c7b9c2d1c89732219cb3fbc40f75675e19206aa13959c1a8046d58ec26a09477

  • SHA512

    0b370a018b36a711f210ae4471ea87385c43f84d7d12b30f20aa5f0b929c81f1e16632439d93dcdd22386b0697640a32d2c170b3397d90d19e491a2c3287ea95

  • SSDEEP

    6144:wSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCTyhhhInkD/mqYf:DZRgUY/fsJcO1KOiXsyhhhInkDef

  Score

  10^/10

  xorddosbotnetdownloaderpersistenceupx

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1