Extracted

• • Target

    atrdadsrcc

  • Size

    659KB

  • MD5

    1d79488a09ef56ae2e60e1985b18e7a2

  • SHA1

    0b25e8f36a9738bb4d2dd2cd711f1aa7213db517

  • SHA256

    4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d

  • SHA512

    b77fda07473e8f3e7ff2a1e25bb556164e3fddb40fe791a0b96538dfcc766f96c6e15082dccc77e79fff73f34497d0c43643134a633ff8740bbc4a287ec0c91b

  • SSDEEP

    12288:aBo9ETRNT9Wn1J0OhS18tDm8PCExfLZ9JCCpyvOH36ybCQ7YLVN1/lFkThVArw:aBo9ANo70OE8A8PCExfLZ/CTvQrKLd/Q

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks CPU configuration

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence
  behavioral1