Analysis
-
max time kernel
155s -
max time network
69s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
22-12-2023 14:24
General
-
Target
c08ed46f971b08258588363986a68193
-
Size
660KB
-
MD5
c08ed46f971b08258588363986a68193
-
SHA1
ede25fe191143cca12c2dc04b9a147e9fd3ac264
-
SHA256
95b9670a733d04cc9bfc48893d6805ee905c2d4cad4e9b946c02a85ca88b96db
-
SHA512
f96d16b2af468d9564890ad792c6db646be6b5ac7b1b2a29f3ae348f30885994a30dfe2e3140aca34d79a9e1509039433c7ba31de6f1a047ad65a2dbdc96feb6
-
SSDEEP
12288:yB6hZ/D+2wZn/Dj3y3NDghlVx3LxAnbZ4F36yT+VmgiZM+yqGTh5AZ2:yB6PL+2S/Dj0NDAVx3LxAnuFjoiLyqGT
Malware Config
Extracted
xorddos
103.25.9.245:3505
103.240.141.50:3505
66.102.253.30:3505
ndns.dsaj2a1.org:3505
ndns.dsaj2a.org:3505
ndns.hcxiaoao.com:3505
ndns.dsaj2a.com:3505
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 27 IoCs
-
Deletes itself 24 IoCs
-
Executes dropped EXE 25 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/c08ed46f971b08258588363986a68193/tmp/c08ed46f971b08258588363986a681931⤵
-
/boot/odctpcocun/boot/odctpcocun1⤵
- Executes dropped EXE
-
/boot/udvvixbcdh/boot/udvvixbcdh ls 15471⤵
- Executes dropped EXE
-
/boot/hxlacnsjas/boot/hxlacnsjas whoami 15471⤵
- Executes dropped EXE
-
/boot/tjqmzwfrwp/boot/tjqmzwfrwp whoami 15471⤵
- Executes dropped EXE
-
/boot/tklatdlxmy/boot/tklatdlxmy "sleep 1" 15471⤵
- Executes dropped EXE
-
/boot/azlfuwawwg/boot/azlfuwawwg "grep \"A\"" 15471⤵
- Executes dropped EXE
-
/boot/uvvdbjezhi/boot/uvvdbjezhi "grep \"A\"" 15471⤵
- Executes dropped EXE
-
/boot/tthpudhmap/boot/tthpudhmap "ls -la" 15471⤵
- Executes dropped EXE
-
/boot/docwuahbue/boot/docwuahbue "ifconfig eth0" 15471⤵
- Executes dropped EXE
-
/boot/ippfpuybgc/boot/ippfpuybgc pwd 15471⤵
- Executes dropped EXE
-
/boot/klumwtityr/boot/klumwtityr "netstat -an" 15471⤵
- Executes dropped EXE
-
/boot/goafncniod/boot/goafncniod "echo \"find\"" 15471⤵
- Executes dropped EXE
-
/boot/exsjlujgej/boot/exsjlujgej "netstat -an" 15471⤵
- Executes dropped EXE
-
/boot/etbcdurxii/boot/etbcdurxii "echo \"find\"" 15471⤵
- Executes dropped EXE
-
/boot/bmppxocyjx/boot/bmppxocyjx "ifconfig eth0" 15471⤵
- Executes dropped EXE
-
/boot/jlwscaroxl/boot/jlwscaroxl "grep \"A\"" 15471⤵
- Executes dropped EXE
-
/boot/vkwibajzkp/boot/vkwibajzkp "sleep 1" 15471⤵
- Executes dropped EXE
-
/boot/rcpfjhbczm/boot/rcpfjhbczm "ps -ef" 15471⤵
- Executes dropped EXE
-
/boot/wtmcrxglbi/boot/wtmcrxglbi "cat resolv.conf" 15471⤵
- Executes dropped EXE
-
/boot/kstsiikztk/boot/kstsiikztk pwd 15471⤵
- Executes dropped EXE
-
/boot/zpjpqgpxlr/boot/zpjpqgpxlr "cd /etc" 15471⤵
- Executes dropped EXE
-
/boot/iznxiblcfb/boot/iznxiblcfb gnome-terminal 15471⤵
- Executes dropped EXE
-
/boot/iykfuhgiqw/boot/iykfuhgiqw gnome-terminal 15471⤵
- Executes dropped EXE
-
/boot/nusoogybdw/boot/nusoogybdw "ls -la" 15471⤵
- Executes dropped EXE
-
/boot/obqztozlyy/boot/obqztozlyy "ls -la" 15471⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
660KB
MD503882a04271ecbdf856ce99ace91385c
SHA1c8b5f15d038cb5bdceb2b5c87ae9c82967923073
SHA25610892aeac2639c786894046a63b13ff124daa4b667ce20db6b4be0226ecacbf7
SHA5128f87c259f58693759e5cdf8493bc88fcb157c6bb995c0d785c12223d9efe8cd57c8d953510edd92b9fb8bdf9c0b160ea770137e5c8b7f59bf4196b21a904e411
-
Filesize
660KB
MD52a29f78fa6870d52219692a0d0de7bb4
SHA1ace43e10fe02f95fcfeafe7784c659607e4c6e20
SHA2567a4f336b693cd2e7f3d9289f8c3c104b3dcfcffb25004700626b2943963ab461
SHA51285fae46db47fbe26e605dbb259d1eab4a26711da836e2670d680e610d142bd0853ba6e99be6e658cb09ec92b8fc30ac4a4a98f04862b0ed7f47fe38bca1070e7
-
Filesize
660KB
MD5f750b11fa84be81d903269df51afc608
SHA195907ca9f1098287a254386fdd643bff36aeaeed
SHA25629d48839d2a259b6f798e0b1c8ca72d672c72d476f6f940391f8e50021581459
SHA5122ff87c59037e3e351518bf10b8d57cf4ea040c0b6573d779c3ec47199079ae366feee77b9081e1f49af9446a026ca5b8c9a938fc56c2f416ed79d76c03f173c0
-
Filesize
660KB
MD5c81c123783e923c202b7fdce744c0cdf
SHA1e1a9ff2d586bba50ff02e25d46722346154e2e5e
SHA2562a3e72ea0415ec903cb339239989b0d1d6346be3fa320ea60f8e01d55ecc49a4
SHA512c3d43e43d73bd08a1ee09408fa85b1c6370c122929b4258ce384c759550897e9844f091c978332f6bdb40dbc4523c833527dfe3f8f246e5ac9899edec9b9794f
-
Filesize
660KB
MD56505429590bb5524bcf87a80119a6870
SHA1ccbff3e0a97956207ecb3bb55bfdffd2c39f46b5
SHA256a959cb7a547a1235d788a7a31fb442b7c95a7a7ff75d4c3d3489558de319da40
SHA51256ac6137cabf4169da59d747b5a6418ee549c30ca4f04b782e1f87bd82d4d84f2f1430ed61cfcfb28c2a3abecbe4cf202079f96deecbfb1e336979be7a866b3f
-
Filesize
660KB
MD5365d260054d75f1902d6f47a95ce8a26
SHA17e50d6e041f28fd768102db85e7ba5f78cf7a0f0
SHA25642fd22a569ab1b2a336d6f921087d85e935ebdba547502bd0fd787a9bc07a912
SHA512c5448f9662bdfab92830cc03e1fd6bcfd2240d9b94d2153cfaa41234ab07844e82d3435976dba30477b135b026bab6a96690862cca1430b1e2f2d3f71b580e14
-
Filesize
660KB
MD5de3ac4ce9ad24927ce37df4372785dac
SHA157f9e8fd935236145f7054b4b227eba4fa22ed94
SHA25648f599b59bf15867cbe1a11aabfb8767ea9d7ba1407b1e83d04c7e2145554e5f
SHA512d1e0db420415aeca95e31ced86021f0d387bbb3ef88904d154f18de57d9760c53aba97c6d1dfb888dc7c941720a845e3ca9bd2293bfb0704aad696153b624321
-
Filesize
660KB
MD59273be7dcd3e9712bdfe296ae96edd33
SHA1eed188c52ae9aa3345338f6ca79b2a1b02d4036a
SHA256672f6762c729ab9b1fef3a6308cb6a042e859a9f44b2fbf774b3e66e5d066d8e
SHA512f11e96d7c5dce2388dcdf734bd453ee7cdea2f7123189b4f12a37e4b5cd41d2abc81c66146cd5a0463d4458b8ca258308d8b8601b331d64d7d428147a0c4370c
-
Filesize
660KB
MD5336330aa0c8d490599286f183b7bf516
SHA1e192ec6914c9d0bdcdcf8939b84a2d58e8809a9b
SHA2562f73d61764b69d244a9f29dc598e5ece53d33cba19b6bdf724b6ecbd713dfdd2
SHA512755d61a1d8c62d0b26e75b3872837b4a047524fa0699d0ad0b74ff18636054a015efac87f08d0bb9920156d51307c82134b9430173cb696a2e858466bba2a9d8
-
Filesize
660KB
MD5abb7bbcf852661850533ecfc6fccfff4
SHA18c56010bf8633fe80a34f5937ff25086b4d481bf
SHA256d5801658eec2eea3d997e53aa6618e319502f073a5a6da7f581a0f8ca2f81f85
SHA51240dae4f20d3ef9c800d4ca64def75ad5b4288b894a93ef8e0e20369ba0e93730984dce708daf35e5ae984d95c682781d9dd0ce5b0741b05278a01fa5497d9e7f
-
Filesize
660KB
MD5fd2b7554346e7c27b9040bbe4bc42204
SHA18fa569cff68387acfccf89201036d9dfd1cd864b
SHA2562b63754d46ef8e6d34078c158e3256386c96feb3f82de760c25205d91afc1168
SHA512e0146a5bcaf70222e72657c16dbcadd0ba363c2f77cdf1a05ffdd52d5bc4ca1a763724b725692194f2b0890390e1772b7d5b1b77cb2b80b613b066b4e0a65fb9
-
Filesize
660KB
MD5885d7842c9b3bc3a0b313f26c6f6db06
SHA16da310d4168ec13f59f2bef1b3bff51067a25430
SHA256a30d12a73e7745e82d919b7ad5b5a9bf658113148f6ef362bf2f693d7a933b67
SHA512cdc5d0be4e0f0eed8b5fc1bae6c583a6769c8d4bd69ca7403816d37d58e5d2ec4455e247421295caa596b938a153d2241af12be02b7b2c198d83fd8bf512fd8a
-
Filesize
660KB
MD5bc30522a713cc52a9651c1e857085991
SHA1b5d4e4c3165214e9f93816957ea395fe0356e460
SHA256164cf1f4a32b7adf3c6eeb03f7a9f8e17dd84e7337f17d522a10d569d67f23a7
SHA512c6ea11a01b0d5c14e2779ec0f11a5fa6eefbbe18e90e0093e54fa4352967c2cc3d4fe9396754972ed6157ff6ea73f2b5d66090ea156bd47e85480fc1cd887bea
-
Filesize
660KB
MD561b9a8a35d8a9832014f9fbddba062d8
SHA16d0545230c410450768c6e7fba6a6a08498637cf
SHA2562bb1ede33af5032909adea1e042252fee8eef6f9b44f13fc425189367744b922
SHA5127afe36ef878c22788b7b27305f0a08047fd1b1dedd9427c763682d8edb2065132c7cec8c6e766001543d422c5e60e99803e79c9da73247149de7de70d034cef3
-
Filesize
660KB
MD5196dff27a3c3e43b1fec0f280be236ef
SHA1af766acb814359e0bca77dee1e473d75e9155c7d
SHA256b6ea1a373a8f3c66da04569742ca2e8f55eb36993c53fb401997bbacbafb0b3e
SHA5121208be22ec61982101d7fa843b2ace14bbf24238d9a1c354b39b85e5ea0cea44b15294dd8c7ea233a9b3f56f37527d62bcc1c1b34b053a8ddef1f53d714dba5e
-
Filesize
660KB
MD519cdece069c818852e3b0dc873878407
SHA1c951c403ccaf6b2c5df36a779c9de01a86ddaa13
SHA256ecf5b3d51aeff1d3934cef2f9b579320da2bdd7114e19a891ee4f363a15ff14c
SHA51222e759e58bc6a7506462312963092342ec25a004325b2f4cd1d18d47d6bb4210cb3410eb72fd47651be81a115de406b14ed528c48bd319a5e60c27da7858c766
-
Filesize
660KB
MD588ee24ca7ac3c3286e1ce32fbd226c9b
SHA16f4b965d9f2dadeb4f748ce3f3a982c0eeed0c54
SHA2561ccff501bf307604551369f1be6c0d621dd1a849cf8a8d44610de3877ae3f9fd
SHA51233ab3ad5521fbb1f0f53e5701c8f77fe3382830883649169acef220d916df28d522cb4b39736d14fa02a8c4cb037b29941146f667770560bef131375bad356ef
-
Filesize
660KB
MD5183419823a2f47cd91dcd887410db56c
SHA16a08585077021ffafb7fb06144580d71177ba6d5
SHA256586ba6faf53533444b02b303e24c309bddc0c563569ea96a8a7ee293ba5ecd2e
SHA512959c35d518d223d2674bd81afeac167cfd816c4e7b2d26689f45c88feae9e1b7afedbc7acf8ace9722431b72a421d1210d9c9931f92c0f270ada78c7a556760d
-
Filesize
660KB
MD56ba7e85e8b0d4bc4d62a14db2afab031
SHA11fec4d7a6f6c2a6156aa46ba9518ff48b698d52a
SHA256b06829ad9087cb23f41b4753547782dc4c8b0d6e169dd98e349a6a9186a8315b
SHA512529688fda58a118263c06d994a209903c70eda031bf1e1be367f81f806d493c9a0382531114176cbcb926a95010d85f1dc1265af382bfd7730c52ee78234b932
-
Filesize
660KB
MD5df171fc3c8d5013c96b3c22a22d383be
SHA18ce23dd7efa3d1ec2539e43b5bab823d91f592b6
SHA25688b97b4a0903acb13539695f96d725ae3c7fe2ef43af75b8f7cf9e0d8db34e60
SHA5124204382245213e790575cd513afe174adf43eb49877752a2d3f7c4e01fd366ffc10bb467d15da105054fca95921954df0fc06954d07b9d54ed23f68a33b5a219
-
Filesize
660KB
MD5d8008a3fe2d04254bd5ec111fabc6863
SHA1df2843c69f73ddc01a88f2e8e1fe8616e5d8f3aa
SHA256374528e2a2c5ef8071134e2a4808f765b6d6b8850ccb93d0fce4eec537099a9c
SHA512f8c19e8ab3a2d52a28e797783a51c9bddbb1154ec0b0b90eeb1b14c43eec0849cd16690f240dd1e32efbc29f8f8fc38fc65bf299ec10fc7124a9c9db40de8642
-
Filesize
660KB
MD54b7c3b8956cf74c89962860d97196601
SHA1abae6ebec83148eb92eb273b20d7b215f3ed50fc
SHA256a102ab30a800e468e2c3bc9bc0b52c008d9a25adc01b1e8fd3edef1436b7d8a0
SHA51256020138412934b8782844c220383d1621122c2cfb99e5eb54ade9140115924e0b2e746144203880f660e3bc58e4b8111021cf8f9fbb6c5ad99ac6d8dde47a8e
-
Filesize
660KB
MD54991c4e6c7c9f8355bcfe79dc4b06405
SHA1d1ef31d51055095905e3ceb99cb2ea89dd75b0e3
SHA25651099db9290dd726af4816dd1a821a9f44d3d1f95e0169caf61e8261fee92afc
SHA512a93318908213b754913eed08b63ce1e30405ac35217db2a8a7e83ff17e76e0bc8b77d79997f8b8a07897540ad7b08f458eb89919efa968c35f8f51d1da9702b6
-
Filesize
660KB
MD58fc9160508b0fcc0ad6b4d906ae0d981
SHA1f1780e8345f98efe3805d83e0695b78626194743
SHA256fd3356bb27784744af1cd61f45ca2437fd23f20b93a78ee4634a32d268de7b9d
SHA51254afe579753efbe88ec3f29a36281cf071b74534b93ea4c58bfdf484a900bd9f74c546ace11b23e18f58220d64ec3ff61634c62b09d507ca6d73c5f2451e8f95
-
Filesize
660KB
MD5040c37222a0aeec8f42b3c9e6f4c678a
SHA1679aec1f8664121ae0109ec3a2dace100751e6e8
SHA25679e1f1f6e1379b8b0d830eea7cc22fa8ccfec76eb43fb2b241636b8de7b0f34a
SHA512b782186de6176c484bb3c59b9d3c9d68ad21f5b07f94976751c6c2738e8d3bae44a03df2b00a818b8ec4d5dbf6c4da3c53881d067278c7379be69cd95076faae
-
Filesize
536KB
MD5790955214f067d3b0724db2b0a2ef888
SHA16882a05b3538f2c51a091ecb780635e45b552167
SHA2567868915b0278474b49f04550c8515e02fae4d956b024acd198091f571b4146b4
SHA512fefc1dcf5f2b08ff2bef68bf3f4700726d1ffb11faeb5f22c8d650e91879f77f88f37d1a52a39dbe4ef7b4c848ead05651625902a04bebb305663f85f51b8425
-
Filesize
27B
MD510f2d31c162999a8ea408a73a526c18d
SHA1450186299423862e8e5afac048dd16cf612ae2bc
SHA256f09847aeafc83a400323c6a7c47f11077a7617699e9da1b20ffb26770257e4f8
SHA512e127260d33e0442b05724ddf2c47554a9e8cc08b4032aba9bee5828d85cebd642ea8eb98af1a7ae02d25dad6b009b1b961430016c905a3555396c5cfffd2bfaf
-
Filesize
660KB
MD5c08ed46f971b08258588363986a68193
SHA1ede25fe191143cca12c2dc04b9a147e9fd3ac264
SHA25695b9670a733d04cc9bfc48893d6805ee905c2d4cad4e9b946c02a85ca88b96db
SHA512f96d16b2af468d9564890ad792c6db646be6b5ac7b1b2a29f3ae348f30885994a30dfe2e3140aca34d79a9e1509039433c7ba31de6f1a047ad65a2dbdc96feb6
-
Filesize
32B
MD555b09e343019599ce994d6c0864ce58c
SHA149bcb5408843eb74089a8e1392dc0a6f880789ab
SHA25687cc62ea90ce296e82a8e6075d7f8dbab8d66107783095339ff501ebc91cbe18
SHA512fb411f2ba0906ce08cd5fa92c2bc1dbea01b7fa2758a028bb0e545dbdb3d974480ba88efaa6229eb64c0be43c2a7704810ec1a75e904cb8daa12b84005a64089