xorddos | c7b9c2d1c89732219cb3fbc40f75675e19206aa13959c1a8046d58ec26a09477

Analysis

max time kernel
155s
max time network
156s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-12-2023 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cab83472f26ffcc4bcf0053f703d44ca
Size

247KB
MD5

cab83472f26ffcc4bcf0053f703d44ca
SHA1

49a6df3d5ff918b1499dc8541d62479ecdc13114
SHA256

c7b9c2d1c89732219cb3fbc40f75675e19206aa13959c1a8046d58ec26a09477
SHA512

0b370a018b36a711f210ae4471ea87385c43f84d7d12b30f20aa5f0b929c81f1e16632439d93dcdd22386b0697640a32d2c170b3397d90d19e491a2c3287ea95
SSDEEP

6144:wSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCTyhhhInkD/mqYf:DZRgUY/fsJcO1KOiXsyhhhInkDef

Score

10^/10

xorddos botnet downloader persistence upx

Malware Config

Extracted

Family

xorddos

Attributes

crc_polynomial
EDB88320

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

Deletes itself 4 IoCs

pid
1651
1657
1660
1655

Executes dropped EXE 25 IoCs

ioc	pid	Process
/usr/bin/byjpjmouij	1565	byjpjmouij
/usr/bin/byjpjmouij	1587	byjpjmouij
/usr/bin/byjpjmouij	1595	byjpjmouij
/usr/bin/byjpjmouij	1598	byjpjmouij
/usr/bin/byjpjmouij	1601	byjpjmouij
/usr/bin/proasxeivp	1604	proasxeivp
/usr/bin/proasxeivp	1607	proasxeivp
/usr/bin/proasxeivp	1610	proasxeivp
/usr/bin/proasxeivp	1613	proasxeivp
/usr/bin/proasxeivp	1616	proasxeivp
/usr/bin/dzcdeqtajh	1619	dzcdeqtajh
/usr/bin/dzcdeqtajh	1622	dzcdeqtajh
/usr/bin/dzcdeqtajh	1625	dzcdeqtajh
/usr/bin/dzcdeqtajh	1628	dzcdeqtajh
/usr/bin/dzcdeqtajh	1631	dzcdeqtajh
/usr/bin/raqgvpylkh	1634	raqgvpylkh
/usr/bin/raqgvpylkh	1637	raqgvpylkh
/usr/bin/raqgvpylkh	1640	raqgvpylkh
/usr/bin/raqgvpylkh	1642	raqgvpylkh
/usr/bin/raqgvpylkh	1645	raqgvpylkh
/usr/bin/vehnhhngqp	1649	vehnhhngqp
/usr/bin/vehnhhngqp	1652	vehnhhngqp
/usr/bin/vehnhhngqp	1654	vehnhhngqp
/usr/bin/vehnhhngqp	1658	vehnhhngqp
/usr/bin/vehnhhngqp	1661	vehnhhngqp

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-5.dat	upx
behavioral1/files/fstream-8.dat	upx
behavioral1/files/fstream-9.dat	upx
behavioral1/files/fstream-11.dat	upx
behavioral1/files/fstream-12.dat	upx
behavioral1/files/fstream-14.dat	upx
behavioral1/files/fstream-15.dat	upx
behavioral1/files/fstream-17.dat	upx
behavioral1/files/fstream-18.dat	upx
behavioral1/files/fstream-20.dat	upx
behavioral1/files/fstream-21.dat	upx

Unexpected DNS network traffic destination 29 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/cron.hourly/gcc4.sh	Process not Found
File opened for modification	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/cab83472f26ffcc4bcf0053f703d44ca

Write file to user bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/usr/bin/byjpjmouij
File opened for modification	/usr/bin/proasxeivp
File opened for modification	/usr/bin/dzcdeqtajh
File opened for modification	/usr/bin/raqgvpylkh
File opened for modification	/usr/bin/vehnhhngqp

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/cab83472f26ffcc4bcf0053f703d44ca
/tmp/cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1552

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc4.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc4.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:1558
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc4.sh/d" /etc/crontab
  2⤵
  - Reads runtime system information
  PID:1559

/bin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/sbin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/usr/bin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/usr/sbin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/usr/local/bin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/usr/local/sbin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/usr/X11R6/bin/chkconfig
chkconfig --add cab83472f26ffcc4bcf0053f703d44ca
1⤵
PID:1555

/bin/update-rc.d
update-rc.d cab83472f26ffcc4bcf0053f703d44ca defaults
1⤵
PID:1557

/sbin/update-rc.d
update-rc.d cab83472f26ffcc4bcf0053f703d44ca defaults
1⤵
PID:1557

/usr/bin/update-rc.d
update-rc.d cab83472f26ffcc4bcf0053f703d44ca defaults
1⤵
PID:1557

/usr/sbin/update-rc.d
update-rc.d cab83472f26ffcc4bcf0053f703d44ca defaults
1⤵
PID:1557
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1563

/usr/bin/byjpjmouij
/usr/bin/byjpjmouij top 1553
1⤵
- Executes dropped EXE
PID:1565

/usr/bin/byjpjmouij
/usr/bin/byjpjmouij sh 1553
1⤵
- Executes dropped EXE
PID:1587

/usr/bin/byjpjmouij
/usr/bin/byjpjmouij gnome-terminal 1553
1⤵
- Executes dropped EXE
PID:1595

/usr/bin/byjpjmouij
/usr/bin/byjpjmouij "ps -ef" 1553
1⤵
- Executes dropped EXE
PID:1598

/usr/bin/byjpjmouij
/usr/bin/byjpjmouij "sleep 1" 1553
1⤵
- Executes dropped EXE
PID:1601

/usr/bin/proasxeivp
/usr/bin/proasxeivp uptime 1553
1⤵
- Executes dropped EXE
PID:1604

/usr/bin/proasxeivp
/usr/bin/proasxeivp ifconfig 1553
1⤵
- Executes dropped EXE
PID:1607

/usr/bin/proasxeivp
/usr/bin/proasxeivp ifconfig 1553
1⤵
- Executes dropped EXE
PID:1610

/usr/bin/proasxeivp
/usr/bin/proasxeivp whoami 1553
1⤵
- Executes dropped EXE
PID:1613

/usr/bin/proasxeivp
/usr/bin/proasxeivp ifconfig 1553
1⤵
- Executes dropped EXE
PID:1616

/usr/bin/dzcdeqtajh
/usr/bin/dzcdeqtajh ls 1553
1⤵
- Executes dropped EXE
PID:1619

/usr/bin/dzcdeqtajh
/usr/bin/dzcdeqtajh sh 1553
1⤵
- Executes dropped EXE
PID:1622

/usr/bin/dzcdeqtajh
/usr/bin/dzcdeqtajh uptime 1553
1⤵
- Executes dropped EXE
PID:1625

/usr/bin/dzcdeqtajh
/usr/bin/dzcdeqtajh gnome-terminal 1553
1⤵
- Executes dropped EXE
PID:1628

/usr/bin/dzcdeqtajh
/usr/bin/dzcdeqtajh "ls -la" 1553
1⤵
- Executes dropped EXE
PID:1631

/usr/bin/raqgvpylkh
/usr/bin/raqgvpylkh "grep \"A\"" 1553
1⤵
- Executes dropped EXE
PID:1634

/usr/bin/raqgvpylkh
/usr/bin/raqgvpylkh ls 1553
1⤵
- Executes dropped EXE
PID:1637

/usr/bin/raqgvpylkh
/usr/bin/raqgvpylkh bash 1553
1⤵
- Executes dropped EXE
PID:1640

/usr/bin/raqgvpylkh
/usr/bin/raqgvpylkh ls 1553
1⤵
- Executes dropped EXE
PID:1642

/usr/bin/raqgvpylkh
/usr/bin/raqgvpylkh id 1553
1⤵
- Executes dropped EXE
PID:1645

/usr/bin/vehnhhngqp
/usr/bin/vehnhhngqp "cat resolv.conf" 1553
1⤵
- Executes dropped EXE
PID:1649

/usr/bin/vehnhhngqp
/usr/bin/vehnhhngqp "route -n" 1553
1⤵
- Executes dropped EXE
PID:1652

/usr/bin/vehnhhngqp
/usr/bin/vehnhhngqp su 1553
1⤵
- Executes dropped EXE
PID:1654

/usr/bin/vehnhhngqp
/usr/bin/vehnhhngqp "ifconfig eth0" 1553
1⤵
- Executes dropped EXE
PID:1658

/usr/bin/vehnhhngqp
/usr/bin/vehnhhngqp uptime 1553
1⤵
- Executes dropped EXE
PID:1661

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/gcc4.sh

Filesize
149B

MD5
4bc702c21d7b2bbb32638e37ec6c3943

SHA1
6b097d447b57c10f10f67ccd5efac4e4d39ddd38

SHA256
f702b3fd1837f30a23c74d5605e0c9cf79a480b942ef7d3bb9f79d448101a8b3

SHA512
19523b3e006eaa41a22a6af5ad1d0b23adf7eb5c653e367229b2d6bf69066a7630d637ae4131e5ae98e63434b00f6af5bef4ece54d7ad66d5c92b8f549f5b3f8

Download Submit
/etc/init.d/cab83472f26ffcc4bcf0053f703d44ca

Filesize
425B

MD5
2ddba026b6e10cf27d6691f37d088811

SHA1
e50bc531a2dee15e99f6d84d28d9bea8b7ddd673

SHA256
0544055741a826052cb37f2cfbecce7e39fd22bcd01acf78010add5111aa687a

SHA512
3adfec1f33dcfb53849a594b028ed86e56e8d306ea33a22063e1767b272377cf8a742964d2cc34673f9a9d1bbc601bd1e9156823a67a9df353cb229f3cf9b6ea

Download Submit
/etc/sedVvF273

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/lib/libudev4.so

Filesize
247KB

MD5
cab83472f26ffcc4bcf0053f703d44ca

SHA1
49a6df3d5ff918b1499dc8541d62479ecdc13114

SHA256
c7b9c2d1c89732219cb3fbc40f75675e19206aa13959c1a8046d58ec26a09477

SHA512
0b370a018b36a711f210ae4471ea87385c43f84d7d12b30f20aa5f0b929c81f1e16632439d93dcdd22386b0697640a32d2c170b3397d90d19e491a2c3287ea95

Download Submit
/run/gcc4.pid

Filesize
32B

MD5
6bf202e953cd0b3acd77d0787e97017d

SHA1
a176ce397b3fe2d2111e26604d6aadd6ed229b77

SHA256
de11ed31eb6ae23bf1437f1f96c7ef6ee281dca4d71d92094b72fcb430362d31

SHA512
8633c2135e3fc66d4c44114cabb018d44d0e81edf64200f502b2a91ad48b37ea31ba1ee3d51f55dcab1834480ddd4bff2bcd84385aa6a1d3d1bb9d3d9d3a77bd

Download Submit
/usr/bin/byjpjmouij

Filesize
247KB

MD5
f1acca24ece2e72c9a255ebb5f2c4cac

SHA1
42a88ff17bf845044c42e29e3499bdda08865d44

SHA256
8fb256f73513339587030ffd1e81261781ecfe9669e79f5be0cbc156884ebe75

SHA512
3ac5deab9b4cf4af19493e0369723673f0c594afe1b4720e22a9866801e0f513ca4ec65c57b6b0b7f6d425c0aee320fab8d2fe8707939367d50686018f12ba12

Download Submit
/usr/bin/byjpjmouij

Filesize
247KB

MD5
9753175fa28dfffa32b838cf12014bba

SHA1
d0ccb914fdd8bae63ac84e15fed6a5068741fcc5

SHA256
56eae3a31664135bfcdfb3cd31fbfa7053c1cbea45284ce4d30ac7581a9670c2

SHA512
e1ba9e56f3420c8448ac6b6c78d14c8a1b873b5a099222f3ed3cf216ba410c3a59de6a867f2ee8baa8127c383acea3b44f13af67c08f6657ef4549d663fa6e15

Download Submit
/usr/bin/dzcdeqtajh

Filesize
247KB

MD5
8ee4ac2cb40aaeb125f06ce6ce19bc6a

SHA1
e98ded90ff30194a901f83ff91f7bdb61fd1ddb0

SHA256
aacf8e82d1c0c17e38d23a1bae37b8b765fe281dc8cc7e8886011b8aff332c78

SHA512
3436d2dd58a18e2a53f42940671948438e974f4f1bfbaa153c1ea6ab40eafdee40550dc32d1cd5986fa2fcff782008eb8a16da4e897f00c2a9b74d856b5ecc86

Download Submit
/usr/bin/dzcdeqtajh

Filesize
247KB

MD5
7177b6913c471191e9815e46ca59b6ae

SHA1
ec578dd2e23bfc6be8e1a76b026a2d3d5d0c5775

SHA256
5c55db7c13baaec9fea6fdd2eb96eee5040443f12aa80a59365052a086b3ca6b

SHA512
d0eef53dacc848d155b5756e203e01e31727708c342d9447be38c3a849d003236138d79effa0ccd2fd58da780e320c0cd678d3fe6000a66a54297e0ba487f072

Download Submit
/usr/bin/proasxeivp

Filesize
247KB

MD5
bb2f73df9af87541a2124ef40fdc2c04

SHA1
a8a2c12e109cc8a3b20581d5d5d6acb0251c2ec3

SHA256
f9ca505a0d2bd2ea8049c461239bbaa14ee84b709516996c817fc5f189bcf05f

SHA512
fd40b5940a3d6ec7ea59b647270182d2a86b5efb4b2ed57d928dd3b5bf861460ac749d07a3ec1cc3b262b7a51017e02419365bea15496187a9bf79c206d7e8ac

Download Submit
/usr/bin/proasxeivp

Filesize
247KB

MD5
e8df4d9fc33dae7235b8b8d3388c03e6

SHA1
10af217d8e6daddfcc54874da4ef1bfbc0660be2

SHA256
8bbefd40f51e8228a65bad72b9974e3b4c21cfea5587f3495fb60eb1172630a5

SHA512
35d48c7dcc11119f1d8e74286ba720c8d516fd1c8af9bea0f1920d39f3c08f7187ba1933b980bd63ca4dc2da32da9431a178708aebf4fa7709320be3453143bb

Download Submit
/usr/bin/raqgvpylkh

Filesize
247KB

MD5
57266ea9b84dcd67162f8684b4f9a91a

SHA1
d8a4bdd5ebb1088504d6e3eed0af56b2e54df35b

SHA256
69692b85686a3c25a0189a58ad750515cb72eda659b35b5f35543c7615c49300

SHA512
a6bf04b15fa769623cbdbe91bc82309c51dd38f66c1821f5d5f9cd42eb3d793ffdbd9f5d4f95905554ba2976dc6ee380c4318ddce8b093eeaa1c8b03e1b1c0ae

Download Submit
/usr/bin/raqgvpylkh

Filesize
247KB

MD5
2e43c7a839007c7f15d1811af6610fb6

SHA1
0d8196d9fdcdbe0ddf36170c672278743079b8f5

SHA256
beee397b0cf439b4068d7d1e1f0428946a889e05ea84bcb46aa3ecff235fb8e3

SHA512
5d382fcf9f5a3461a691cc192754e24b1aefa49a0a8d8b63dcd7218cd85ead4f013f7abba1cb15fb4e505fe8fb8ddfbbf9a7d939a219f9222d90aec96e987535

Download Submit
/usr/bin/vehnhhngqp

Filesize
247KB

MD5
80a50bf357e91c1fe60b8587c7b24df5

SHA1
9614dda7ab15f43af763ceb583d6101b240ee4e7

SHA256
c44e840c57a684d7a00b298df865994e128fd253e83d9a7c4c4db37141dd23fc

SHA512
71364fc22a94902c675ff9d5d49bd2dc3d30b7611763bc3e03638ae20e391c35909624a408407ac308e45479ca58c47f1b37157e892940d5e3f4931e04cf11e2

Download Submit
/usr/bin/vehnhhngqp

Filesize
247KB

MD5
e7d9f2ab1cc6b5cd91dc2410f21010ad

SHA1
36904d672a712c828194b1fd74ed0d8197560220

SHA256
fac0bf3167aca877cb8fac3f8d3c808400cb5d53a93932b59fb2712364a3e3c7

SHA512
dba4397313006a21a58977a247d54637fee64cd9984284e90a20d1f578c968002256408d1c87f4c03dbaeb7a4541fdc19b2aa7e57d5c6765167fda08ddf3b616

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads