Overview

overview

10

Static

static

10

f60e7e3d7e...ff78f0

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20-12-2023 17:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f60e7e3d7e68fac8a5a5827974ff78f0

  • Size

    647KB

  • MD5

    f60e7e3d7e68fac8a5a5827974ff78f0

  • SHA1

    7bc91c75d85097f885ad507d8c6c7d8b6924b22e

  • SHA256

    a518b18d18736dbf2f9c75442753dc9489e46cfc7fab169f80bff4b7bf09c625

  • SHA512

    b99b7d4d7bb43ad175977fe9aff8d7cc9a3a3aac2258f5a28cb0edf92bf5b28a71c85ba90cb13b961662f1e486fd6a1312ad98af10bd5072533d08537216ee4d

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Ton7p6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1m76wvnDWXMN

Score
10/10
xorddosbotnetdownloaderpersistence

Malware Config

Extracted

Family

xorddos

C2

http://info1.3000uc.com/b/u.php

aaaaaaaaaa.re67das.com:5859

vtqq.f3322.net:25

bii.f3322.net:25
Attributes
  • crc_polynomial

    EDB88320

xor.plain

Signatures

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos
  • XorDDoS payload 4 IoCs
  • Deletes itself 2 IoCs
  • Executes dropped EXE 25 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence
  • Modifies init.d 1 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/f60e7e3d7e68fac8a5a5827974ff78f0
    /tmp/f60e7e3d7e68fac8a5a5827974ff78f0
    1⤵
      PID:1533
    • /boot/vfbzgutxrw
      /boot/vfbzgutxrw
      1⤵
      • Executes dropped EXE
      PID:1536
    • /bin/sh
      sh -c "sed -i '/\\/etc\\/cron.hourly\\/cron.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab"
      1⤵
      • Creates/modifies Cron job
      PID:1542
      • /bin/sed
        sed -i "/\\/etc\\/cron.hourly\\/cron.sh/d" /etc/crontab
        2⤵
        • Reads runtime system information
        PID:1543
    • /bin/update-rc.d
      update-rc.d vfbzgutxrw defaults
      1⤵
        PID:1541
      • /sbin/update-rc.d
        update-rc.d vfbzgutxrw defaults
        1⤵
          PID:1541
        • /usr/bin/update-rc.d
          update-rc.d vfbzgutxrw defaults
          1⤵
            PID:1541
          • /usr/sbin/update-rc.d
            update-rc.d vfbzgutxrw defaults
            1⤵
              PID:1541
              • /bin/systemctl
                systemctl daemon-reload
                2⤵
                • Reads runtime system information
                PID:1552
            • /bin/chkconfig
              chkconfig --add vfbzgutxrw
              1⤵
                PID:1539
              • /sbin/chkconfig
                chkconfig --add vfbzgutxrw
                1⤵
                  PID:1539
                • /usr/bin/chkconfig
                  chkconfig --add vfbzgutxrw
                  1⤵
                    PID:1539
                  • /usr/sbin/chkconfig
                    chkconfig --add vfbzgutxrw
                    1⤵
                      PID:1539
                    • /usr/local/bin/chkconfig
                      chkconfig --add vfbzgutxrw
                      1⤵
                        PID:1539
                      • /usr/local/sbin/chkconfig
                        chkconfig --add vfbzgutxrw
                        1⤵
                          PID:1539
                        • /usr/X11R6/bin/chkconfig
                          chkconfig --add vfbzgutxrw
                          1⤵
                            PID:1539
                          • /boot/gnmcqorbxn
                            /boot/gnmcqorbxn "echo \"find\"" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1550
                          • /boot/uzyacawwnt
                            /boot/uzyacawwnt pwd 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1578
                          • /boot/tpmouafshf
                            /boot/tpmouafshf "sleep 1" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1591
                          • /boot/fexpbuwihy
                            /boot/fexpbuwihy "ps -ef" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1594
                          • /boot/zmonvskqcd
                            /boot/zmonvskqcd "grep \"A\"" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1599
                          • /boot/pfkidytegx
                            /boot/pfkidytegx "echo \"find\"" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1602
                          • /boot/fjuaxhqtem
                            /boot/fjuaxhqtem su 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1605
                          • /boot/gihtxhyccd
                            /boot/gihtxhyccd "grep \"A\"" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1608
                          • /boot/fxgyrureul
                            /boot/fxgyrureul "netstat -antop" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1611
                          • /boot/xkmpfcuwxj
                            /boot/xkmpfcuwxj "netstat -an" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1614
                          • /boot/dnpptmcumt
                            /boot/dnpptmcumt id 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1632
                          • /boot/igqxysaqxr
                            /boot/igqxysaqxr uptime 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1635
                          • /boot/zartfhnbfi
                            /boot/zartfhnbfi uptime 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1638
                          • /boot/yxzfabdhcm
                            /boot/yxzfabdhcm uptime 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1641
                          • /boot/hqlvkomaso
                            /boot/hqlvkomaso "netstat -an" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1644
                          • /boot/daaqnqrmwj
                            /boot/daaqnqrmwj "netstat -an" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1647
                          • /boot/lwozuxmalb
                            /boot/lwozuxmalb sh 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1650
                          • /boot/jmubomozop
                            /boot/jmubomozop id 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1653
                          • /boot/saqbvelriv
                            /boot/saqbvelriv who 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1656
                          • /boot/kpedxekjro
                            /boot/kpedxekjro "echo \"find\"" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1659
                          • /boot/dzpdtwrsxs
                            /boot/dzpdtwrsxs "netstat -an" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1662
                          • /boot/xdxewtfkui
                            /boot/xdxewtfkui bash 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1665
                          • /boot/fqswgqzcyz
                            /boot/fqswgqzcyz ifconfig 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1668
                          • /boot/uygagcwrtv
                            /boot/uygagcwrtv "ps -ef" 1537
                            1⤵
                            • Executes dropped EXE
                            PID:1671

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • /boot/jmubomozop
                            Filesize

                            172KB

                            MD5

                            efe4c9f27cf150869445851dac8f37e1

                            SHA1

                            bf9ae744320a639ab636bd95606db93cf1ab82b0

                            SHA256

                            679d791dacf9ea61fcf2d6cc90608e77370a28360af01f2439941babb3254729

                            SHA512

                            f97eb457be8c5329e36dabc8eb457caa2078e98316d73495a4fbd4222eba5c7cd422647b09567c7f7f63e9e4291f09bd61f6a6732b824d5ea0e468788db0fb20

                            Download Submit

                          • /boot/tpmouafshf
                            Filesize

                            480KB

                            MD5

                            872e17d95d7986256b0e57f4eeb39db3

                            SHA1

                            2013b41d59623a0629e89cf7a5cb8eb1951d4450

                            SHA256

                            a35e8f5ff727170159dc762ea2b2d7c3f929329f203d20293d213e4190473b41

                            SHA512

                            e07ab8e18241f63ced256b7d07dfefdd727c4dba7408f8bde17a74b0de53ee2c119fc14aef8edcfd98a3830d4df32014b9afcce79500ceed6e0b74b71eaa5e9f

                            Download Submit

                          • /boot/uzyacawwnt
                            Filesize

                            647KB

                            MD5

                            f60e7e3d7e68fac8a5a5827974ff78f0

                            SHA1

                            7bc91c75d85097f885ad507d8c6c7d8b6924b22e

                            SHA256

                            a518b18d18736dbf2f9c75442753dc9489e46cfc7fab169f80bff4b7bf09c625

                            SHA512

                            b99b7d4d7bb43ad175977fe9aff8d7cc9a3a3aac2258f5a28cb0edf92bf5b28a71c85ba90cb13b961662f1e486fd6a1312ad98af10bd5072533d08537216ee4d

                            Download Submit

                          • /lib/udev/udev
                            Filesize

                            488KB

                            MD5

                            ba2b3b3e32d6da7c3d9c73e5a0f7e806

                            SHA1

                            a2e4ce93703539e6caa7619c9827e04bd22272d4

                            SHA256

                            e8a406d1622a8d84b68baa19cff80af13fa885b3878779c98475db9bf47f957b

                            SHA512

                            8834eb84b78ebc33b0730673a6b1e02b29fba34da923b34619a8aa30d266dba7c1dbe1e0192a9656c33e27b7d98de5fd74af44d7cf78c2adc1a51a317f12f9dd

                            Download Submit