Extracted

• • Target
    c10ffeaf668f69c1124f6cd5fe0dff3b
  • Size 595KB
  • SHA256 292adb2a5917259e10fbfce5e936f993dad8bf1d813e3b9d5d9c9bf4ea4b8037
  • MD5 c10ffeaf668f69c1124f6cd5fe0dff3b
  • SHA1 99b10f29a401f8846b1b94b0906ff9bad8128117
  • SHA512 1040df753d9a4c27cbcba709a5ac3120a001cac78803103c639c0506bfefa13836910baa391c17dd6123c494dc2fcea0a23202488306b8455eedae3072673f74
  • SSDEEP 12288:9bf8IKMnQXbeyFlGF/5oYAx//tqdx286yNrMu9h7Dxu9hc7L:tf8INobe0kxoYAx//tQ26TzD4XcP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1