Extracted

• • Target

    f46885b16a85fd6f20a6d8c6b3836e74

  • Size

    247KB

  • MD5

    f46885b16a85fd6f20a6d8c6b3836e74

  • SHA1

    21822af4b28c6174c4af73df8df87f1ea0282db4

  • SHA256

    98982204bff4e5a3c206cfda13e2f2e899ab82db957596faf004d3698f707305

  • SHA512

    d4d156ee913999e5b6a1bb488050510df3e96f739f0fd1a276acf4cd1f91fd9b77167b79dbfd93e940323c9c468e6300ce74d47070a7640c63d158ae4c25f188

  • SSDEEP

    6144:JSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NC9ihhhAYIl/mqYf:YZRgUY/fsJcO1KOiXSihhhAPef

  Score

  10^/10

  xorddosbotnetdownloaderpersistenceupx

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1