xorddos | cfa4c887555c315182f2a4dc290633fdec3140a10e4480e877ff1a7627d89878

Analysis

max time kernel
146s
max time network
154s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a891a96d6af45865e5fe6142b40eb77
Size

610KB
MD5

7a891a96d6af45865e5fe6142b40eb77
SHA1

674ad6a918d4dc38c4c03860da2fddcd5da61b57
SHA256

cfa4c887555c315182f2a4dc290633fdec3140a10e4480e877ff1a7627d89878
SHA512

9d4900c38200643b15320dbbeec6b06b3597398abe2fd31e1965e1d224baa008edbfa4b5dbc9cab00e33a70f5a0b1892fc6d540fd440779f69df08d99248da37
SSDEEP

12288:WBmHsnhar0nJ7FGY5HRYxC1mqiL40qFCWU7k/VU6yZNnXgW4UlUuTh1AG:WBmHgaUVFGAR11mTL40q/7GpXgUl/91h

Score

10^/10

xorddos antivm botnet downloader persistence

Malware Config

Extracted

Family

xorddos

http://www1.gggatat456.com/dd.rar

ppp.gggatat456.com:1520

ppp.xxxatat456.com:1520

Attributes

crc_polynomial
EDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 9 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_xorddos
behavioral1/files/fstream-10.dat	family_xorddos
behavioral1/files/fstream-11.dat	family_xorddos
behavioral1/files/fstream-12.dat	family_xorddos
behavioral1/files/fstream-13.dat	family_xorddos
behavioral1/files/fstream-14.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos
behavioral1/files/fstream-17.dat	family_xorddos
behavioral1/files/fstream-18.dat	family_xorddos

Deletes itself 1 IoCs

pid
1645

Executes dropped EXE 22 IoCs

ioc	pid	Process
/usr/bin/rrptlpticz	1549	rrptlpticz
/usr/bin/rrptlpticz	1554	rrptlpticz
/usr/bin/rrptlpticz	1557	rrptlpticz
/usr/bin/rrptlpticz	1560	rrptlpticz
/usr/bin/rrptlpticz	1562	rrptlpticz
/usr/bin/sglxebuzzc	1584	sglxebuzzc
/usr/bin/sglxebuzzc	1587	sglxebuzzc
/usr/bin/sglxebuzzc	1589	sglxebuzzc
/usr/bin/sglxebuzzc	1592	sglxebuzzc
/usr/bin/sglxebuzzc	1596	sglxebuzzc
/usr/bin/bohnrnrdil	1602	bohnrnrdil
/usr/bin/bohnrnrdil	1605	bohnrnrdil
/usr/bin/bohnrnrdil	1607	bohnrnrdil
/usr/bin/bohnrnrdil	1610	bohnrnrdil
/usr/bin/bohnrnrdil	1613	bohnrnrdil
/usr/bin/motfhugycv	1628	motfhugycv
/usr/bin/motfhugycv	1630	motfhugycv
/usr/bin/motfhugycv	1634	motfhugycv
/usr/bin/motfhugycv	1636	motfhugycv
/usr/bin/motfhugycv	1639	motfhugycv
/usr/bin/aidaoafyig	1643	aidaoafyig
/usr/bin/aidaoafyig	1646	aidaoafyig

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/cron.hourly/gcc.sh	Process not Found
File opened for modification	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/7a891a96d6af45865e5fe6142b40eb77

Write file to user bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/usr/bin/rrptlpticz
File opened for modification	/usr/bin/sglxebuzzc
File opened for modification	/usr/bin/bohnrnrdil
File opened for modification	/usr/bin/motfhugycv
File opened for modification	/usr/bin/aidaoafyig

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/rs_dev	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/7a891a96d6af45865e5fe6142b40eb77
/tmp/7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1533

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:1539
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
  2⤵
  - Reads runtime system information
  PID:1540

/bin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/sbin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/usr/bin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/usr/sbin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/usr/local/bin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/usr/local/sbin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/usr/X11R6/bin/chkconfig
chkconfig --add 7a891a96d6af45865e5fe6142b40eb77
1⤵
PID:1536

/bin/update-rc.d
update-rc.d 7a891a96d6af45865e5fe6142b40eb77 defaults
1⤵
PID:1538

/sbin/update-rc.d
update-rc.d 7a891a96d6af45865e5fe6142b40eb77 defaults
1⤵
PID:1538

/usr/bin/update-rc.d
update-rc.d 7a891a96d6af45865e5fe6142b40eb77 defaults
1⤵
PID:1538

/usr/sbin/update-rc.d
update-rc.d 7a891a96d6af45865e5fe6142b40eb77 defaults
1⤵
PID:1538
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1541

/usr/bin/rrptlpticz
/usr/bin/rrptlpticz id 1534
1⤵
- Executes dropped EXE
PID:1549

/usr/bin/rrptlpticz
/usr/bin/rrptlpticz id 1534
1⤵
- Executes dropped EXE
PID:1554

/usr/bin/rrptlpticz
/usr/bin/rrptlpticz uptime 1534
1⤵
- Executes dropped EXE
PID:1557

/usr/bin/rrptlpticz
/usr/bin/rrptlpticz who 1534
1⤵
- Executes dropped EXE
PID:1560

/usr/bin/rrptlpticz
/usr/bin/rrptlpticz who 1534
1⤵
- Executes dropped EXE
PID:1562

/usr/bin/sglxebuzzc
/usr/bin/sglxebuzzc "ifconfig eth0" 1534
1⤵
- Executes dropped EXE
PID:1584

/usr/bin/sglxebuzzc
/usr/bin/sglxebuzzc ls 1534
1⤵
- Executes dropped EXE
PID:1587

/usr/bin/sglxebuzzc
/usr/bin/sglxebuzzc "route -n" 1534
1⤵
- Executes dropped EXE
PID:1589

/usr/bin/sglxebuzzc
/usr/bin/sglxebuzzc "sleep 1" 1534
1⤵
- Executes dropped EXE
PID:1592

/usr/bin/sglxebuzzc
/usr/bin/sglxebuzzc pwd 1534
1⤵
- Executes dropped EXE
PID:1596

/usr/bin/bohnrnrdil
/usr/bin/bohnrnrdil uptime 1534
1⤵
- Executes dropped EXE
PID:1602

/usr/bin/bohnrnrdil
/usr/bin/bohnrnrdil who 1534
1⤵
- Executes dropped EXE
PID:1605

/usr/bin/bohnrnrdil
/usr/bin/bohnrnrdil sh 1534
1⤵
- Executes dropped EXE
PID:1607

/usr/bin/bohnrnrdil
/usr/bin/bohnrnrdil su 1534
1⤵
- Executes dropped EXE
PID:1610

/usr/bin/bohnrnrdil
/usr/bin/bohnrnrdil "ls -la" 1534
1⤵
- Executes dropped EXE
PID:1613

/usr/bin/motfhugycv
/usr/bin/motfhugycv "ls -la" 1534
1⤵
- Executes dropped EXE
PID:1628

/usr/bin/motfhugycv
/usr/bin/motfhugycv ls 1534
1⤵
- Executes dropped EXE
PID:1630

/usr/bin/motfhugycv
/usr/bin/motfhugycv id 1534
1⤵
- Executes dropped EXE
PID:1634

/usr/bin/motfhugycv
/usr/bin/motfhugycv top 1534
1⤵
- Executes dropped EXE
PID:1636

/usr/bin/motfhugycv
/usr/bin/motfhugycv pwd 1534
1⤵
- Executes dropped EXE
PID:1639

/usr/bin/aidaoafyig
/usr/bin/aidaoafyig "echo \"find\"" 1534
1⤵
- Executes dropped EXE
PID:1643

/usr/bin/aidaoafyig
/usr/bin/aidaoafyig "ps -ef" 1534
1⤵
- Executes dropped EXE
PID:1646

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/gcc.sh

Filesize
228B

MD5
3bab747cedc5f0ebe86aaa7f982470cd

SHA1
3c7d1c6931c2b3dae39d38346b780ea57c8e6142

SHA256
74d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5

SHA512
21e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42

Download Submit
/etc/init.d/7a891a96d6af45865e5fe6142b40eb77

Filesize
425B

MD5
31790cd5239426f2690c21f268933808

SHA1
6b559bfa78c81908940e19b6cd2c547eb06e4c5e

SHA256
a58c0b94ffee53c9e727b8c4dc6956e6f27d78b927d2d63369a8cf1f31a152bd

SHA512
96cb62a4293b4c2cc64bc221e46feccb82143b425866a522067a63ca27ce886354b18853d5b535c1845be32b97ed1a64ddd2dba279d17f8c4598e14f7c020729

Download Submit
/etc/sedaE5EKA

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/lib/libudev.so

Filesize
328KB

MD5
8c74d06631c4a42e2faca39ad379a3f7

SHA1
d5559ace2d056096076dc25b18a69349099ceeef

SHA256
61e7c265f6bea9e0e5963b72ed016851cf9f6f43e7c24ea6824c1dc1e01cfec8

SHA512
5cabe33042a06ba9e6c82ba772f3ab612e23da09cc3c2dedb0f0ec92a5b5ac5de08b6e1c2aa40a828c5936da6b56b48d34d06a050938332790f3dedd93fc583c

Download Submit
/usr/bin/bohnrnrdil

Filesize
431KB

MD5
b56ae8866ba4e22c906dd18edd521e30

SHA1
f29e51ba1582eb453e1a9374eb4869371cc83042

SHA256
c9cd02ec4a4b8da9594f5b2ebc4d09605364cadf67de7df4b2264b3eb47605f0

SHA512
d477f58ac82d1d9c849e5d972cb89392957d45719056f6620034409a7af1dd1ed9c4528d5d6c773be915f48e0c0090f2cd616d0145ea1ea14f8638fe6995aa96

Download Submit
/usr/bin/bohnrnrdil

Filesize
610KB

MD5
01e3509480fa02a31787680f35dddc4d

SHA1
f888bdfcef0fb55ed3a3c2da84a21cdc37d0a3b1

SHA256
fc54791db5a7a6e098b9df504625a83d49794b4ff0b4b42f2f27e5b52ecb8a92

SHA512
6467c62ccb7d817777497341019dfed8407304d6d34a8da33e5ca23eea8a146e672612156c8e81be5be163f46d28d29f270f3232e2aad491e4e268920d51e5a2

Download Submit
/usr/bin/bohnrnrdil

Filesize
610KB

MD5
64691bfed67c54d57db5e82b0771c85c

SHA1
652e7d97ebc5aa63dfd6be91627e540392362611

SHA256
3ee02221d6c820550651b474e3e2396b4d74f99753ad0d1eb338ef771de41203

SHA512
579f2386fad59abf54ad25da8edbfdf1d53dd868306af5d9299b53804a4226543193f6797c9c709f3822bba4cd138933a97127558fa1b2a09a490e463dc6db03

Download Submit
/usr/bin/motfhugycv

Filesize
610KB

MD5
5ba967174732564e2ab55f3b27d3d5ca

SHA1
2873de242ee072e06466944ade6da5ec062ed9e3

SHA256
f4cbbdbfbeea715d42ffdfd14d104c331a825a3ffc02560e2035c8a5fa6fc802

SHA512
e0dac9b9c366526880e3481c6ae46c8b38ee382f7ab44e3aeded208710117e9ee41eafe956bdaa95a24341142687a5e09dedcbef077601525259d5c0248d8066

Download Submit
/usr/bin/motfhugycv

Filesize
610KB

MD5
da87f99d5e14309f99e51897d7ea9cb3

SHA1
0b8b0392c440bb1c1497f0316491e2a79be8bde5

SHA256
0b8b56448313bf5180f5c3ce379f6bfcb7de4ca6ccf028616d3ada534a27a05d

SHA512
dcd1466de07ba1edd0b5d2d60f895f49a2de0bf9b500a68f5b616e2a94d263d94d44ad7cfc8eb5d44e4c27368c0f4691feb332ed3d0c8ae033c9acb7fcbb045c

Download Submit
/usr/bin/sglxebuzzc

Filesize
610KB

MD5
7a891a96d6af45865e5fe6142b40eb77

SHA1
674ad6a918d4dc38c4c03860da2fddcd5da61b57

SHA256
cfa4c887555c315182f2a4dc290633fdec3140a10e4480e877ff1a7627d89878

SHA512
9d4900c38200643b15320dbbeec6b06b3597398abe2fd31e1965e1d224baa008edbfa4b5dbc9cab00e33a70f5a0b1892fc6d540fd440779f69df08d99248da37

Download Submit
/usr/bin/sglxebuzzc

Filesize
610KB

MD5
99100ab32b295567a427a7759d074077

SHA1
5ef47019bb0a257cf3f2816d98d0143a9ef11f1f

SHA256
1516c741a3f664fd9d6c2e25617b11caaf472cb0005f42bf0b07058b399a4276

SHA512
63dc559ffed32e45c459d0cfb4cee4d2e6ec53234735f2427aed809a4ae67e66280f96b29c37fbd20e00433f0bd7d7f86cba491e38d4583d663b9440516a1549

Download Submit
/usr/bin/sglxebuzzc

Filesize
610KB

MD5
35faf2acc2d5cb5b2871b78c484477b6

SHA1
2a403db25a67b92c77ba809cd53bc8a4d7b6ce50

SHA256
08481b9d2834eed0b7449c777e3795c00788229363655f3ca94894b631c0be0a

SHA512
3ad882c322cefe1b647dd6c8298823db2f9fa761c6041e8f62647aeb905c4574edb53d743743a52e4f9e8c9e24f861485a29de0d070f7aed7e734841dedee56e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads