xorddos | 98982204bff4e5a3c206cfda13e2f2e899ab82db957596faf004d3698f707305

Analysis

max time kernel
152s
max time network
158s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20-12-2023 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f46885b16a85fd6f20a6d8c6b3836e74
Size

247KB
MD5

f46885b16a85fd6f20a6d8c6b3836e74
SHA1

21822af4b28c6174c4af73df8df87f1ea0282db4
SHA256

98982204bff4e5a3c206cfda13e2f2e899ab82db957596faf004d3698f707305
SHA512

d4d156ee913999e5b6a1bb488050510df3e96f739f0fd1a276acf4cd1f91fd9b77167b79dbfd93e940323c9c468e6300ce74d47070a7640c63d158ae4c25f188
SSDEEP

6144:JSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NC9ihhhAYIl/mqYf:YZRgUY/fsJcO1KOiXSihhhAPef

Score

10^/10

xorddos botnet downloader persistence upx

Malware Config

Extracted

Family

xorddos

Attributes

crc_polynomial
EDB88320

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

Deletes itself 2 IoCs

pid
1653
1655

Executes dropped EXE 22 IoCs

ioc	pid	Process
/usr/bin/gaeqndwwey	1554	gaeqndwwey
/usr/bin/gaeqndwwey	1556	gaeqndwwey
/usr/bin/gaeqndwwey	1578	gaeqndwwey
/usr/bin/gaeqndwwey	1582	gaeqndwwey
/usr/bin/gaeqndwwey	1585	gaeqndwwey
/usr/bin/bjrxierdrn	1589	bjrxierdrn
/usr/bin/bjrxierdrn	1591	bjrxierdrn
/usr/bin/bjrxierdrn	1594	bjrxierdrn
/usr/bin/bjrxierdrn	1598	bjrxierdrn
/usr/bin/bjrxierdrn	1600	bjrxierdrn
/usr/bin/zaepsfseuj	1618	zaepsfseuj
/usr/bin/zaepsfseuj	1620	zaepsfseuj
/usr/bin/zaepsfseuj	1624	zaepsfseuj
/usr/bin/zaepsfseuj	1626	zaepsfseuj
/usr/bin/zaepsfseuj	1629	zaepsfseuj
/usr/bin/zzuwjfpvvy	1633	zzuwjfpvvy
/usr/bin/zzuwjfpvvy	1635	zzuwjfpvvy
/usr/bin/zzuwjfpvvy	1638	zzuwjfpvvy
/usr/bin/zzuwjfpvvy	1641	zzuwjfpvvy
/usr/bin/zzuwjfpvvy	1644	zzuwjfpvvy
/usr/bin/dqedsqlhdg	1650	dqedsqlhdg
/usr/bin/dqedsqlhdg	1652	dqedsqlhdg

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-5.dat	upx
behavioral1/files/fstream-8.dat	upx
behavioral1/files/fstream-9.dat	upx
behavioral1/files/fstream-10.dat	upx
behavioral1/files/fstream-11.dat	upx
behavioral1/files/fstream-12.dat	upx
behavioral1/files/fstream-14.dat	upx
behavioral1/files/fstream-15.dat	upx
behavioral1/files/fstream-16.dat	upx
behavioral1/files/fstream-20.dat	upx
behavioral1/files/fstream-21.dat	upx

Unexpected DNS network traffic destination 28 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/cron.hourly/gcc4.sh	Process not Found
File opened for modification	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/f46885b16a85fd6f20a6d8c6b3836e74

Write file to user bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/usr/bin/bjrxierdrn
File opened for modification	/usr/bin/zaepsfseuj
File opened for modification	/usr/bin/zzuwjfpvvy
File opened for modification	/usr/bin/dqedsqlhdg
File opened for modification	/usr/bin/gaeqndwwey

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl

/tmp/f46885b16a85fd6f20a6d8c6b3836e74
/tmp/f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1538

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc4.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc4.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:1544
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc4.sh/d" /etc/crontab
  2⤵
  - Reads runtime system information
  PID:1545

/bin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/sbin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/usr/bin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/usr/sbin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/usr/local/bin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/usr/local/sbin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/usr/X11R6/bin/chkconfig
chkconfig --add f46885b16a85fd6f20a6d8c6b3836e74
1⤵
PID:1541

/bin/update-rc.d
update-rc.d f46885b16a85fd6f20a6d8c6b3836e74 defaults
1⤵
PID:1543

/sbin/update-rc.d
update-rc.d f46885b16a85fd6f20a6d8c6b3836e74 defaults
1⤵
PID:1543

/usr/bin/update-rc.d
update-rc.d f46885b16a85fd6f20a6d8c6b3836e74 defaults
1⤵
PID:1543

/usr/sbin/update-rc.d
update-rc.d f46885b16a85fd6f20a6d8c6b3836e74 defaults
1⤵
PID:1543
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1553

/usr/bin/gaeqndwwey
/usr/bin/gaeqndwwey "ls -la" 1539
1⤵
- Executes dropped EXE
PID:1554

/usr/bin/gaeqndwwey
/usr/bin/gaeqndwwey whoami 1539
1⤵
- Executes dropped EXE
PID:1556

/usr/bin/gaeqndwwey
/usr/bin/gaeqndwwey "cd /etc" 1539
1⤵
- Executes dropped EXE
PID:1578

/usr/bin/gaeqndwwey
/usr/bin/gaeqndwwey id 1539
1⤵
- Executes dropped EXE
PID:1582

/usr/bin/gaeqndwwey
/usr/bin/gaeqndwwey "grep \"A\"" 1539
1⤵
- Executes dropped EXE
PID:1585

/usr/bin/bjrxierdrn
/usr/bin/bjrxierdrn ls 1539
1⤵
- Executes dropped EXE
PID:1589

/usr/bin/bjrxierdrn
/usr/bin/bjrxierdrn ls 1539
1⤵
- Executes dropped EXE
PID:1591

/usr/bin/bjrxierdrn
/usr/bin/bjrxierdrn "ls -la" 1539
1⤵
- Executes dropped EXE
PID:1594

/usr/bin/bjrxierdrn
/usr/bin/bjrxierdrn "netstat -antop" 1539
1⤵
- Executes dropped EXE
PID:1598

/usr/bin/bjrxierdrn
/usr/bin/bjrxierdrn gnome-terminal 1539
1⤵
- Executes dropped EXE
PID:1600

/usr/bin/zaepsfseuj
/usr/bin/zaepsfseuj "echo \"find\"" 1539
1⤵
- Executes dropped EXE
PID:1618

/usr/bin/zaepsfseuj
/usr/bin/zaepsfseuj "cat resolv.conf" 1539
1⤵
- Executes dropped EXE
PID:1620

/usr/bin/zaepsfseuj
/usr/bin/zaepsfseuj uptime 1539
1⤵
- Executes dropped EXE
PID:1624

/usr/bin/zaepsfseuj
/usr/bin/zaepsfseuj whoami 1539
1⤵
- Executes dropped EXE
PID:1626

/usr/bin/zaepsfseuj
/usr/bin/zaepsfseuj "cd /etc" 1539
1⤵
- Executes dropped EXE
PID:1629

/usr/bin/zzuwjfpvvy
/usr/bin/zzuwjfpvvy "grep \"A\"" 1539
1⤵
- Executes dropped EXE
PID:1633

/usr/bin/zzuwjfpvvy
/usr/bin/zzuwjfpvvy "sleep 1" 1539
1⤵
- Executes dropped EXE
PID:1635

/usr/bin/zzuwjfpvvy
/usr/bin/zzuwjfpvvy whoami 1539
1⤵
- Executes dropped EXE
PID:1638

/usr/bin/zzuwjfpvvy
/usr/bin/zzuwjfpvvy "netstat -antop" 1539
1⤵
- Executes dropped EXE
PID:1641

/usr/bin/zzuwjfpvvy
/usr/bin/zzuwjfpvvy ifconfig 1539
1⤵
- Executes dropped EXE
PID:1644

/usr/bin/dqedsqlhdg
/usr/bin/dqedsqlhdg whoami 1539
1⤵
- Executes dropped EXE
PID:1650

/usr/bin/dqedsqlhdg
/usr/bin/dqedsqlhdg "ifconfig eth0" 1539
1⤵
- Executes dropped EXE
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/gcc4.sh

Filesize
149B

MD5
4bc702c21d7b2bbb32638e37ec6c3943

SHA1
6b097d447b57c10f10f67ccd5efac4e4d39ddd38

SHA256
f702b3fd1837f30a23c74d5605e0c9cf79a480b942ef7d3bb9f79d448101a8b3

SHA512
19523b3e006eaa41a22a6af5ad1d0b23adf7eb5c653e367229b2d6bf69066a7630d637ae4131e5ae98e63434b00f6af5bef4ece54d7ad66d5c92b8f549f5b3f8

Download Submit
/etc/init.d/f46885b16a85fd6f20a6d8c6b3836e74

Filesize
425B

MD5
f8450f23c46d2bf74bd5b2da8b6e164d

SHA1
859d69c9058fde9be72fa16af8d949315d8d486e

SHA256
6855a141a19f23c42b6a7c6e7b701f9adb87c8bfa64455d830e49cc5d9ca07cd

SHA512
451879151007a5eebe26521063a99373ab992144f4aacb50f836baa5263e3b8dfaead69fcfa8f9b6e2ec335dd010517a8e4f26578f5ba91e4ce806543038bdda

Download Submit
/etc/sedma6GeG

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/lib/libudev4.so

Filesize
247KB

MD5
f46885b16a85fd6f20a6d8c6b3836e74

SHA1
21822af4b28c6174c4af73df8df87f1ea0282db4

SHA256
98982204bff4e5a3c206cfda13e2f2e899ab82db957596faf004d3698f707305

SHA512
d4d156ee913999e5b6a1bb488050510df3e96f739f0fd1a276acf4cd1f91fd9b77167b79dbfd93e940323c9c468e6300ce74d47070a7640c63d158ae4c25f188

Download Submit
/run/gcc4.pid

Filesize
32B

MD5
9bd60db0a1041e2c1d9cd3c2ce3c11b7

SHA1
68e393f2aa51b7b14b175c86b3a06f4ea40fd7ea

SHA256
3752089072b5963b934c8538c7857b601c00ec5c4e64a617b0b69848234a8411

SHA512
9af9382528286655fa44dab69fabe394dfb22e1810b54c7d58745bda6d8c1cfe2665b1cc1feefe67857bdb90c47b37637735c6a0b35710188ac2935844df4afb

Download Submit
/usr/bin/bjrxierdrn

Filesize
120KB

MD5
36261bc3108ebc74612f8cc64009b2f4

SHA1
dc04b168fbd42c3e77cdcb819ae745c7190e74db

SHA256
dfe1d6649cb04792f4791d4e6ef0682ed3a5645a60ee63fe0009776fd3c2456b

SHA512
9ab80e47da52ae439010c0b54629f2c91a77f56771622bbd484302279c9dc0fc26fb10298f6aea9d437e23cf13151226d7419f0ae5920ea17b3d5c9b3b3249e5

Download Submit
/usr/bin/bjrxierdrn

Filesize
247KB

MD5
ea32b9b1e42a89053de787ecce47c585

SHA1
2aadb09ec4cc3b201d52d448dcdef0e48e049623

SHA256
20b7cfec3731efc5427ff78a509b77866ffcf9ec1fc77df14c8a6a5d5219481f

SHA512
4cb002869324c226f1fb52f1b8e32631165361b7bb7b368666843eacb774f6e4607b2510558f30240def7949e5b8fb4687ec7ca34e1c585718f8b46327279c73

Download Submit
/usr/bin/bjrxierdrn

Filesize
247KB

MD5
49c308cfa9268cee37bfcf5b66a35bed

SHA1
e2f8a936d7be9cf90882247d5c6501b4e7ae1fbb

SHA256
d461ec12e2b6d359496ac70208fa76f1a0d6d332119892127ca1bd54ebb97d85

SHA512
3dae4696c9929cb4930a01890b02e65900db0f5891307f4276bc8cb39883b5a248ef68dc9eb409fc23eadadb7b6ecf4b0876f6fb39aa5829bd5d04e7a68f276c

Download Submit
/usr/bin/dqedsqlhdg

Filesize
247KB

MD5
c1ec334a4d138a5d712438550bd656e2

SHA1
460706fbc36a884caa10fd4ec50bacfff7a3095c

SHA256
92797c2cfe0ad1d5dad224bd7a2940c80182b1b6a7922718d07037230039d78f

SHA512
0b2ef9c5072bc52270218511632317312000c899cdfd99eb9f7b84d749235001fd4f5852cefe0249eef1a31caf50011ab17f033186c3dc54d34fbd780d3dca14

Download Submit
/usr/bin/dqedsqlhdg

Filesize
247KB

MD5
8778ef00b525903fb10652989cc0ff50

SHA1
c1ac55806c974e0f21bb70f3d29184c410da1066

SHA256
d07f438838d44c4a837063a20cb053b46ec3f126c827dab43277e36a88447bf7

SHA512
536fc2ec564bbaa256c150f4b15b11cb0cce6f21332edca8b4e0d546c3336c6d163450b6d1b25148f1c211ac689b8181b3b1986c01fe9d2d0b6684a0504d01e1

Download Submit
/usr/bin/gaeqndwwey

Filesize
247KB

MD5
317acb147de14a5c5be154f54126fe3d

SHA1
7204148d77dde4d80f15e6e34d387beb4750ec2e

SHA256
338c5a6d85334ba8c6471bf413f28bfa822d13c932302c947c6ec0bcf92be5ec

SHA512
27d96f93081b64ea572fe04699ae1d68227113dfad85223542860e54e686a9a0b85f8e949253d545bdc34d330d18a67727bccd8e39fe8b46e5b20d7c6bba0119

Download Submit
/usr/bin/gaeqndwwey

Filesize
247KB

MD5
ff208a798a395a7608dafa9d7c938f84

SHA1
37bfd614bf7d415253f7c4fe15148dec2cf3e13b

SHA256
bf25cf32210d320ceeac85caad6122fc2d0955587bca2328a6d93c0be6871f28

SHA512
113fbf8159206b44f5808a23ac4c1e676292c5b4bddec8e6d9c81034c63d5c8de07c2bab453345264251a7c0788e70df816f13984d686bb27c37883bf2da0e3b

Download Submit
/usr/bin/zaepsfseuj

Filesize
247KB

MD5
00dac0c25889ce4c66e0fe060134a0ed

SHA1
764bc611d655150893d2a7cba60707197302b5c7

SHA256
00c4a5e84b3df65f7d03101422b74303d376cd34164cdaeec36bd361b3b09d27

SHA512
78d0980ff9dc2eba17a42cbbec68c961e42f63829b78e40c5fabcb4d75bf48b1bc9022883ce18ab4851cb9ba29a8b5cad63e474622078403891f511600267b6a

Download Submit
/usr/bin/zaepsfseuj

Filesize
247KB

MD5
b40b94ccc2f4d77a1805c2fcdf2ff7c5

SHA1
fac06320c78369524f5b9269d0b416849da6cbbe

SHA256
21b3f856f215329ad9229cc27e54723693dbfa6621d60062355c4af595144b0b

SHA512
108b8052e289dcc7a0de7b85799fe2d40bb1550d21a664f93fdcb02f316caa5c6530bbc645ddf2b5826c4b2096febdf044c28a95b507b9f1a2bfdd50a99bcb3e

Download Submit
/usr/bin/zzuwjfpvvy

Filesize
24KB

MD5
8c46cbe4f4296b5e900101e12780f430

SHA1
1bf2b203cf171151879ccd34d8bf7278ff90eda5

SHA256
7f91e8a04cbecd91ab5bb9d9621d47e665058dc67cba5ead3e436fb1fec67948

SHA512
b8c15d7ced10396080fb7e95af192e856861d6de450638149bb5e4549a1e25ede52fa98b6bdfa1c818d06775f59f4a62d185b6cce5aa208fcf507d2d55bd1e1a

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads