xorddos | c3ca04f3ea1f643ec2e04117efbcba263646307732b3ea1a27fa0cdb038651ac

Analysis

max time kernel
13s
max time network
146s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231222-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3765193e92c10eab1dc09a2c89857734
Size

610KB
MD5

3765193e92c10eab1dc09a2c89857734
SHA1

6bb8b7eb78646a88a0bf1a9067ea4998fff4de06
SHA256

c3ca04f3ea1f643ec2e04117efbcba263646307732b3ea1a27fa0cdb038651ac
SHA512

01f7ad629ef40fd55f47d25ecc969c42297583668967c21a10512cfccfb5e07402a61d56716954ecf8c29e49eb44e7aa69293f0ca5a72b55d87c5dbe39d7141c
SSDEEP

12288:WBmHsnhar0nJ7FGY5HRYxC1mqiL40qFCWU7k/gU6yZNnXgW4UlUuTh1AG:WBmHgaUVFGAR11mTL40q/qGpXgUl/91h

Score

10^/10

xorddos antivm botnet discovery downloader persistence

Malware Config

Extracted

Family

xorddos

http://www1.gggatat456.com/dd.rar

ppp.gggatat456.com:1523

ppp.xxxatat456.com:1523

Attributes

crc_polynomial
EDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 8 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_xorddos
behavioral1/files/fstream-7.dat	family_xorddos
behavioral1/files/fstream-8.dat	family_xorddos
behavioral1/files/fstream-9.dat	family_xorddos
behavioral1/files/fstream-11.dat	family_xorddos
behavioral1/files/fstream-12.dat	family_xorddos
behavioral1/files/fstream-14.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos

Executes dropped EXE 14 IoCs

ioc	pid	Process
/usr/bin/fnjdxcyzaj	1589	fnjdxcyzaj
/usr/bin/fnjdxcyzaj	1612	fnjdxcyzaj
/usr/bin/fnjdxcyzaj	1615	fnjdxcyzaj
/usr/bin/fnjdxcyzaj	1619	fnjdxcyzaj
/usr/bin/fnjdxcyzaj	1625	fnjdxcyzaj
/usr/bin/kigpxpghko	1629	kigpxpghko
/usr/bin/kigpxpghko	1632	kigpxpghko
/usr/bin/kigpxpghko	1634	kigpxpghko
/usr/bin/kigpxpghko	1638	kigpxpghko
/usr/bin/kigpxpghko	1641	kigpxpghko
/usr/bin/yeggpzlutb	1644	yeggpzlutb
/usr/bin/yeggpzlutb	1647	yeggpzlutb
/usr/bin/yeggpzlutb	1650	yeggpzlutb
/usr/bin/yeggpzlutb	1653	yeggpzlutb

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/cron.hourly/gcc.sh	Process not Found
File opened for modification	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/3765193e92c10eab1dc09a2c89857734

Write file to user bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/usr/bin/fnjdxcyzaj
File opened for modification	/usr/bin/kigpxpghko
File opened for modification	/usr/bin/yeggpzlutb

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/rs_dev	Process not Found
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl

/tmp/3765193e92c10eab1dc09a2c89857734
/tmp/3765193e92c10eab1dc09a2c89857734
1⤵
PID:1567

/bin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/sbin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/usr/bin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/usr/sbin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/usr/local/bin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/usr/local/sbin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/usr/X11R6/bin/chkconfig
chkconfig --add 3765193e92c10eab1dc09a2c89857734
1⤵
PID:1579

/bin/update-rc.d
update-rc.d 3765193e92c10eab1dc09a2c89857734 defaults
1⤵
PID:1581

/sbin/update-rc.d
update-rc.d 3765193e92c10eab1dc09a2c89857734 defaults
1⤵
PID:1581

/usr/bin/update-rc.d
update-rc.d 3765193e92c10eab1dc09a2c89857734 defaults
1⤵
PID:1581

/usr/sbin/update-rc.d
update-rc.d 3765193e92c10eab1dc09a2c89857734 defaults
1⤵
PID:1581
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1584

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:1582
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Reads runtime system information
  PID:1583

/usr/bin/fnjdxcyzaj
/usr/bin/fnjdxcyzaj bash 1577
1⤵
- Executes dropped EXE
PID:1589

/usr/bin/fnjdxcyzaj
/usr/bin/fnjdxcyzaj whoami 1577
1⤵
- Executes dropped EXE
PID:1612

/usr/bin/fnjdxcyzaj
/usr/bin/fnjdxcyzaj "grep \"A\"" 1577
1⤵
- Executes dropped EXE
PID:1615

/usr/bin/fnjdxcyzaj
/usr/bin/fnjdxcyzaj pwd 1577
1⤵
- Executes dropped EXE
PID:1619

/usr/bin/fnjdxcyzaj
/usr/bin/fnjdxcyzaj su 1577
1⤵
- Executes dropped EXE
PID:1625

/usr/bin/kigpxpghko
/usr/bin/kigpxpghko ls 1577
1⤵
- Executes dropped EXE
PID:1629

/usr/bin/kigpxpghko
/usr/bin/kigpxpghko uptime 1577
1⤵
- Executes dropped EXE
PID:1632

/usr/bin/kigpxpghko
/usr/bin/kigpxpghko uptime 1577
1⤵
- Executes dropped EXE
PID:1634

/usr/bin/kigpxpghko
/usr/bin/kigpxpghko who 1577
1⤵
- Executes dropped EXE
PID:1638

/usr/bin/kigpxpghko
/usr/bin/kigpxpghko top 1577
1⤵
- Executes dropped EXE
PID:1641

/usr/bin/yeggpzlutb
/usr/bin/yeggpzlutb ifconfig 1577
1⤵
- Executes dropped EXE
PID:1644

/usr/bin/yeggpzlutb
/usr/bin/yeggpzlutb who 1577
1⤵
- Executes dropped EXE
PID:1647

/usr/bin/yeggpzlutb
/usr/bin/yeggpzlutb top 1577
1⤵
- Executes dropped EXE
PID:1650

/usr/bin/yeggpzlutb
/usr/bin/yeggpzlutb uptime 1577
1⤵
- Executes dropped EXE
PID:1653

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Service Discovery

T1046

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/gcc.sh

Filesize
228B

MD5
3bab747cedc5f0ebe86aaa7f982470cd

SHA1
3c7d1c6931c2b3dae39d38346b780ea57c8e6142

SHA256
74d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5

SHA512
21e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42

Download Submit
/etc/init.d/3765193e92c10eab1dc09a2c89857734

Filesize
425B

MD5
09998abccf5ee7c749d9e0fd6e4f2e62

SHA1
6a2043d67bd6b966ef1bdec884061e642907f619

SHA256
c964d5f7b71ff1d7ebb88dc40436f0dd415f51acc689fab075dc145e275d6ba3

SHA512
4321b8d26cfd03f3243f7065329d7612a97e3da346923af8695db34b28cefe83bf2ba2fd7204598849f7a8b8649c4f5742d9a8b7393430abfa8bb4c74c99cc7e

Download Submit
/etc/sedMgg94W

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/lib/libudev.so

Filesize
322KB

MD5
255af299f61bd79a50c7fb777f6532df

SHA1
58b86ed26199da08cc16551d3f9214814d82c789

SHA256
ffc105c1c876a38c3e80c14653635536ad49595f687cffe873fd76a5f5491f8a

SHA512
495868ae5829028bfc88bb447c412bd8b7d66ecef011e6d7de31dddd8e4c427d2bb0b8f280d24f1d8220b766c196246f564497b529ec79ac77b43452429f558d

Download Submit
/run/gcc.pid

Filesize
32B

MD5
293a5b98795a902cb4b87ca312746e6c

SHA1
7d0fecdbe8c6405e78ec132bd7308db3445ae3e1

SHA256
1551865fe38e0c2f117dccfd529ab1d7e1220a5acfe217bc39edd2fb6dc2ea47

SHA512
93f03e707a97917f2ab31aeee09ca531069690535d0d08086926c1f88d6f40c19290c33a8a4278a9bed3e513e7cf3f889c665093a3f6c4e1d894c4a0081ddd12

Download Submit
/usr/bin/fnjdxcyzaj

Filesize
610KB

MD5
3765193e92c10eab1dc09a2c89857734

SHA1
6bb8b7eb78646a88a0bf1a9067ea4998fff4de06

SHA256
c3ca04f3ea1f643ec2e04117efbcba263646307732b3ea1a27fa0cdb038651ac

SHA512
01f7ad629ef40fd55f47d25ecc969c42297583668967c21a10512cfccfb5e07402a61d56716954ecf8c29e49eb44e7aa69293f0ca5a72b55d87c5dbe39d7141c

Download Submit
/usr/bin/fnjdxcyzaj

Filesize
610KB

MD5
dacd902503baef1c8000fdb56bbd769c

SHA1
d283a8920ac2854c7c519eea4495d5d9f2d6da76

SHA256
2992e37dd91a7f50f1237fd94603a9062a079b7089eca45e0fb3292c1941ea4c

SHA512
bf7ad63ea6545ea38109bb16000d8e5a9ffeeaa69847008123c86b86e282e8e63e387ccbbe69acfd9bff64a7c77e57e0d9f671df403d393cb443f6e22660a72b

Download Submit
/usr/bin/fnjdxcyzaj

Filesize
610KB

MD5
a5753206f695fd928e544294781a849e

SHA1
45fd13efb8124462dbfdcbfcb49af2e37aa7e096

SHA256
c74d19112235af72d269212360dba58da0c0905350b42f58ecbe0da9979e5581

SHA512
3ff06d84b9f80ae813bc9437042b6165981bc8676564eac27f64a7f532d7372a8a4a2fc05579fe87bdd405b75e53306171c27e360e047424b7e09a9f79c3d602

Download Submit
/usr/bin/kigpxpghko

Filesize
610KB

MD5
6efafe2fa79eae34cf3ab08000ba5f6c

SHA1
424b1a1043cd1a0c6f4e15f9bb35521ef327ffcb

SHA256
1b82ddb065ee485c51cc51893a7b438c745c51c2a73963b7fe259ddaa0047e49

SHA512
ec9bd67bd1f9e26f3880a8d1a0cb2a800e43ae350b33cc3ddb6313a91713ef7615d29474c1fe4067bdaeea0533fd3801f6d7b4234e26c1b407ce9e1b33151849

Download Submit
/usr/bin/kigpxpghko

Filesize
610KB

MD5
ad34b2923a292c9ec86b44f8d7aceed3

SHA1
ad7360a82b063e8b4f6f8e80d1271ef694cb79a2

SHA256
620b167dcf31d65ad423abaaf7cf11845acf71d69d6af57914cc5affe4867774

SHA512
356881157b371589d7a63db9be9cf71ed1e145a80983ed6221c1c4e561374745ed7237c4efd0b1d15f2ad614ed6693b4e8ae997b4b465336fc104e5d907a396b

Download Submit
/usr/bin/yeggpzlutb

Filesize
610KB

MD5
00efb4378acb8fd3a495b9975209fd5a

SHA1
6bed5d9125e4158b600e61be46353368856c9d6d

SHA256
97a52d1b82129d4b925409e906a315d96c0f8599a34d6381d16c1658c9ddaf3b

SHA512
bc7234fd6f971d8f6e3d15f53c977ff6d3dc8ed78c8dc6ff02851b22ba4c3a802079ba6f2110a85090b9fa40a5280e665ae0d0a715142a1e0f7845829cec81ec

Download Submit
/usr/bin/yeggpzlutb

Filesize
610KB

MD5
5f0442690977c8501beafb46ef54db0a

SHA1
d93bcecda9e2ae0b3bbbedda98be08582aa6b7a9

SHA256
512ef9948155f0c3b886fe7c98b2161fd608f110d0fcebb97583171a29305764

SHA512
b583f69f540f3c277a692d804edf20d818d39bf07682784adbbdc58a014566c6358aae9ce4cc8489e3641c6863d8852d0fca1856cf3b8c6310dce30b46c5c093

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads