Extracted

• • Target

    c3337a3e278ce7b8b2916f6b493b9b6e

  • Size

    647KB

  • MD5

    c3337a3e278ce7b8b2916f6b493b9b6e

  • SHA1

    7e8f8dc6f89411a2a6f409687ba3c43f5b2eac4e

  • SHA256

    e8b6b5fd2f6cdd43baad3210652ab93a3f79aaefa7e1d7febe03669778c60c65

  • SHA512

    d8fcf9771d9865c131b6f8eb5bd6f3aa07598970e62ce46f73d36983ea1ed537e688321a6505dd5eae508085c448b82e22b74233547e00d9c9874656bde5967b

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Ton3p6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1m36wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1