Extracted

• • Target
    854f9f0fd26d823d0b678b7228154138
  • Size 596KB
  • SHA256 42629d9d813e59c3d2b7aac0da644ddb1824a8b286b39393ad50a945d51ab363
  • MD5 854f9f0fd26d823d0b678b7228154138
  • SHA1 ebaed77107d5ba6ff3d45155232d3c3e9fe34373
  • SHA512 217d5d6d7436c98ea7b89d008fb1fd671ca327ba8b61edd48a5507a15717f105ab4d4ace798a90afffcb8ae0062041005777fd6bfd1f31dc014a7ccf9e9d6497
  • SSDEEP 12288:bfTGy+n69+5rTlFEcMWbHvx5SGEuWdMF6yxm9Ah7Dxu9hc7L:rTG/0+5dq4bHvx5SGodMLTD4XcP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1