Extracted

• • Target

    c08ed46f971b08258588363986a68193

  • Size

    660KB

  • MD5

    c08ed46f971b08258588363986a68193

  • SHA1

    ede25fe191143cca12c2dc04b9a147e9fd3ac264

  • SHA256

    95b9670a733d04cc9bfc48893d6805ee905c2d4cad4e9b946c02a85ca88b96db

  • SHA512

    f96d16b2af468d9564890ad792c6db646be6b5ac7b1b2a29f3ae348f30885994a30dfe2e3140aca34d79a9e1509039433c7ba31de6f1a047ad65a2dbdc96feb6

  • SSDEEP

    12288:yB6hZ/D+2wZn/Dj3y3NDghlVx3LxAnbZ4F36yT+VmgiZM+yqGTh5AZ2:yB6PL+2S/Dj0NDAVx3LxAnuFjoiLyqGT

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks CPU configuration

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1