Extracted

• • Target

    6c7dbfcef9364588a0afd8d1a1eab82f

  • Size

    647KB

  • MD5

    6c7dbfcef9364588a0afd8d1a1eab82f

  • SHA1

    d46952dca5d5eaf1bb177f39611eae7cf0ede1f5

  • SHA256

    077574431ff1b30d6985d75d3b047f7df05c1d4ee471f68f84ad24909764ea33

  • SHA512

    141c02290e27316f5a1932d5121d6e4f08ece2a02d333d63adbd40918f69e699a0ac89992eedc376e4856e1d3e11622915dc467d3d59eb65307082927854ad46

  • SSDEEP

    12288:RBRO1UmJJ0nHgBL9YfJip2qm+x4h1Tonbp6y07l7mtBDvnD/u9hMHDB:RBRpmJ+HyL9AiAqm+x4h1mb6wvnDWXMN

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1