xorddos | a7eb1d26c8069a933254341be5b5ebf61818d08d0867d64d48890e0ba80cff87

Analysis

max time kernel
152s
max time network
156s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfde10b9d5468ee167d578bbfe93a0dc
Size

596KB
MD5

cfde10b9d5468ee167d578bbfe93a0dc
SHA1

61646e20beb7f816cea1713f92f1d1da92450e8e
SHA256

a7eb1d26c8069a933254341be5b5ebf61818d08d0867d64d48890e0ba80cff87
SHA512

0faec1f88a4263c72dc87ce14c31e32ec9f353b27d944a32e0849e4015d7e0d50023ddc122673cd3b12d8614e7a53b49c5cf87758990c21a7e6e8b6d8a8a4596
SSDEEP

12288:bfTGy+n69+5rTlFEcMWbHvx5SGEuWdiF6yxm9Ah7Dxu9hc7L:rTG/0+5dq4bHvx5SGodiLTD4XcP

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

http://info1.3000uc.com/b/u.php

gh.dsaj2a1.org:2879

iosapp622.ddns.net:2879

173.247.233.62:2879

Attributes

crc_polynomial
EDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 11 IoCs

Processes:

resource	yara_rule
/lib/libgcc4.so	family_xorddos
/usr/bin/hamypkpbep	family_xorddos
/usr/bin/hamypkpbep	family_xorddos
/usr/bin/ncgvlfouch	family_xorddos
/usr/bin/ncgvlfouch	family_xorddos
/usr/bin/xbsnokxptg	family_xorddos
/usr/bin/xbsnokxptg	family_xorddos
/usr/bin/hmprubylnr	family_xorddos
/usr/bin/hmprubylnr	family_xorddos
/usr/bin/hmprubylnr	family_xorddos
/usr/bin/nzvabqkwpm	family_xorddos

Deletes itself 1 IoCs

Processes:

pid

1642

pid
1642

Executes dropped EXE 22 IoCs

Processes:

hamypkpbephamypkpbephamypkpbephamypkpbephamypkpbepncgvlfouchncgvlfouchncgvlfouchncgvlfouchncgvlfouchxbsnokxptgxbsnokxptgxbsnokxptgxbsnokxptgxbsnokxptghmprubylnrhmprubylnrhmprubylnrhmprubylnrhmprubylnrnzvabqkwpmnzvabqkwpm

ioc	pid	process
/usr/bin/hamypkpbep	1545	hamypkpbep
/usr/bin/hamypkpbep	1547	hamypkpbep
/usr/bin/hamypkpbep	1551	hamypkpbep
/usr/bin/hamypkpbep	1554	hamypkpbep
/usr/bin/hamypkpbep	1557	hamypkpbep
/usr/bin/ncgvlfouch	1583	ncgvlfouch
/usr/bin/ncgvlfouch	1586	ncgvlfouch
/usr/bin/ncgvlfouch	1589	ncgvlfouch
/usr/bin/ncgvlfouch	1592	ncgvlfouch
/usr/bin/ncgvlfouch	1594	ncgvlfouch
/usr/bin/xbsnokxptg	1598	xbsnokxptg
/usr/bin/xbsnokxptg	1600	xbsnokxptg
/usr/bin/xbsnokxptg	1604	xbsnokxptg
/usr/bin/xbsnokxptg	1607	xbsnokxptg
/usr/bin/xbsnokxptg	1611	xbsnokxptg
/usr/bin/hmprubylnr	1623	hmprubylnr
/usr/bin/hmprubylnr	1625	hmprubylnr
/usr/bin/hmprubylnr	1628	hmprubylnr
/usr/bin/hmprubylnr	1632	hmprubylnr
/usr/bin/hmprubylnr	1634	hmprubylnr
/usr/bin/nzvabqkwpm	1640	nzvabqkwpm
/usr/bin/nzvabqkwpm	1643	nzvabqkwpm

Unexpected DNS network traffic destination 20 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228

Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

sh

description ioc process

File opened for modification /etc/crontab sh
File opened for modification /etc/cron.hourly/udev.sh
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/cfde10b9d5468ee167d578bbfe93a0dc

description	ioc	process
File opened for modification	/etc/crontab	sh
File opened for modification	/etc/cron.hourly/udev.sh

description	ioc
File opened for modification	/etc/init.d/cfde10b9d5468ee167d578bbfe93a0dc

Write file to user bin folder 1 TTPs 5 IoCs

Hijack Execution Flow

T1574

Processes:

description	ioc
File opened for modification	/usr/bin/nzvabqkwpm
File opened for modification	/usr/bin/hamypkpbep
File opened for modification	/usr/bin/ncgvlfouch
File opened for modification	/usr/bin/xbsnokxptg
File opened for modification	/usr/bin/hmprubylnr

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

Processes:

sedsystemctl

description	ioc	process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl

/tmp/cfde10b9d5468ee167d578bbfe93a0dc
/tmp/cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1529

/bin/sh
sh -c "sed -i '/\\/etc\\/cron.hourly\\/udev.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/udev.sh' >> /etc/crontab"
1⤵
- Creates/modifies Cron job
PID:1535
- /bin/sed
  sed -i "/\\/etc\\/cron.hourly\\/udev.sh/d" /etc/crontab
  2⤵
  - Reads runtime system information
  PID:1536

/bin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/sbin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/usr/bin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/usr/sbin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/usr/local/bin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/usr/local/sbin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/usr/X11R6/bin/chkconfig
chkconfig --add cfde10b9d5468ee167d578bbfe93a0dc
1⤵
PID:1532

/bin/update-rc.d
update-rc.d cfde10b9d5468ee167d578bbfe93a0dc defaults
1⤵
PID:1534

/sbin/update-rc.d
update-rc.d cfde10b9d5468ee167d578bbfe93a0dc defaults
1⤵
PID:1534

/usr/bin/update-rc.d
update-rc.d cfde10b9d5468ee167d578bbfe93a0dc defaults
1⤵
PID:1534

/usr/sbin/update-rc.d
update-rc.d cfde10b9d5468ee167d578bbfe93a0dc defaults
1⤵
PID:1534
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1540

/usr/bin/hamypkpbep
/usr/bin/hamypkpbep who 1530
1⤵
- Executes dropped EXE
PID:1545

/usr/bin/hamypkpbep
/usr/bin/hamypkpbep id 1530
1⤵
- Executes dropped EXE
PID:1547

/usr/bin/hamypkpbep
/usr/bin/hamypkpbep "ls -la" 1530
1⤵
- Executes dropped EXE
PID:1551

/usr/bin/hamypkpbep
/usr/bin/hamypkpbep top 1530
1⤵
- Executes dropped EXE
PID:1554

/usr/bin/hamypkpbep
/usr/bin/hamypkpbep "grep \"A\"" 1530
1⤵
- Executes dropped EXE
PID:1557

/usr/bin/ncgvlfouch
/usr/bin/ncgvlfouch ifconfig 1530
1⤵
- Executes dropped EXE
PID:1583

/usr/bin/ncgvlfouch
/usr/bin/ncgvlfouch ifconfig 1530
1⤵
- Executes dropped EXE
PID:1586

/usr/bin/ncgvlfouch
/usr/bin/ncgvlfouch who 1530
1⤵
- Executes dropped EXE
PID:1589

/usr/bin/ncgvlfouch
/usr/bin/ncgvlfouch whoami 1530
1⤵
- Executes dropped EXE
PID:1592

/usr/bin/ncgvlfouch
/usr/bin/ncgvlfouch "ps -ef" 1530
1⤵
- Executes dropped EXE
PID:1594

/usr/bin/xbsnokxptg
/usr/bin/xbsnokxptg pwd 1530
1⤵
- Executes dropped EXE
PID:1598

/usr/bin/xbsnokxptg
/usr/bin/xbsnokxptg "cat resolv.conf" 1530
1⤵
- Executes dropped EXE
PID:1600

/usr/bin/xbsnokxptg
/usr/bin/xbsnokxptg gnome-terminal 1530
1⤵
- Executes dropped EXE
PID:1604

/usr/bin/xbsnokxptg
/usr/bin/xbsnokxptg "netstat -an" 1530
1⤵
- Executes dropped EXE
PID:1607

/usr/bin/xbsnokxptg
/usr/bin/xbsnokxptg pwd 1530
1⤵
- Executes dropped EXE
PID:1611

/usr/bin/hmprubylnr
/usr/bin/hmprubylnr sh 1530
1⤵
- Executes dropped EXE
PID:1623

/usr/bin/hmprubylnr
/usr/bin/hmprubylnr bash 1530
1⤵
- Executes dropped EXE
PID:1625

/usr/bin/hmprubylnr
/usr/bin/hmprubylnr "sleep 1" 1530
1⤵
- Executes dropped EXE
PID:1628

/usr/bin/hmprubylnr
/usr/bin/hmprubylnr ls 1530
1⤵
- Executes dropped EXE
PID:1632

/usr/bin/hmprubylnr
/usr/bin/hmprubylnr "grep \"A\"" 1530
1⤵
- Executes dropped EXE
PID:1634

/usr/bin/nzvabqkwpm
/usr/bin/nzvabqkwpm "cd /etc" 1530
1⤵
- Executes dropped EXE
PID:1640

/usr/bin/nzvabqkwpm
/usr/bin/nzvabqkwpm "cat resolv.conf" 1530
1⤵
- Executes dropped EXE
PID:1643

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/udev.sh

Filesize
146B

MD5
ddb9a901eadce597284d68ebd9fe9311

SHA1
1d26318bbe55f2f936ae1015df656535427083c2

SHA256
3bb8ebd394bcaea3f083d93daa3c3bcf918a4618f84ab45a1942759d16b070fc

SHA512
e94bd51f02c323d2376e666a9c56a87c2f55d1805b44762d4bc6d5d60ca52e85ce996ba51142213ba783ac858660a3ba254988215b0f4d398b1e99bf132a5d1c

Download Submit
/etc/init.d/cfde10b9d5468ee167d578bbfe93a0dc

Filesize
425B

MD5
41392f2a82b1e26ec262dbb363dbda6d

SHA1
82b54f4066ec191ce118ded210652a2d2e8d0fe0

SHA256
dc00ddc54dedaabfe74735842993b42b1ef478b3fa3803bf06f0bf6e71c16648

SHA512
6da752747cf1ef68ac265df39d78b4874fa5c8db08a57df12387c090dd1781b3cf248b5f05e5e8e6ee201557709d3cdda58d5cc579ca1be6a4305524013a88e3

Download Submit
/etc/sedhLnj2S

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/lib/libgcc4.so

Filesize
596KB

MD5
cfde10b9d5468ee167d578bbfe93a0dc

SHA1
61646e20beb7f816cea1713f92f1d1da92450e8e

SHA256
a7eb1d26c8069a933254341be5b5ebf61818d08d0867d64d48890e0ba80cff87

SHA512
0faec1f88a4263c72dc87ce14c31e32ec9f353b27d944a32e0849e4015d7e0d50023ddc122673cd3b12d8614e7a53b49c5cf87758990c21a7e6e8b6d8a8a4596

Download Submit
/run/udev.pid

Filesize
32B

MD5
d873849f8f99db97515b0bec77fc4197

SHA1
b0471029000fb2260a86b89eb41e8b7a8cee38ae

SHA256
27cd6e1121a0c6154154258454c31ef2382b7c23bd98b171de21d24b75bca301

SHA512
9b6d939db2d54c977d4e6654568602313120165f45d402b21268664db8d7c2efbd28666ed36b437c98e01862988639335b0fd0ec5e68cbd821868546fca1c0f0

Download Submit
/usr/bin/hamypkpbep

Filesize
596KB

MD5
67e3cfb2756121930ebc9ca717aa796c

SHA1
cfa5bba9eee5e6d065e81b664c812678937dd14b

SHA256
2774d1c94f5977bb78e7f11c23cd924560e712a7dc8e4bb5af2a8a941e3830c2

SHA512
058ff53c60fac67d7f06a9c18b7066466cee49b9185e8984cbfacee5130bb6c850df401e1176befcb9dc192e63aec1421c3c1a067c0996e61b5e9dedf533148b

Download Submit
/usr/bin/hamypkpbep

Filesize
596KB

MD5
40fbedacb82c48eda675f80acbb31a86

SHA1
82a0410250494fe67cd70feb3b01f98aee8404b4

SHA256
4544960e14985470178feb42c78a129ebb10b5ef373ce697348bca6cfc7cb009

SHA512
128bb37c66cc95d8677663c0de493842643b4ddc2f05bbefab221da68a17e8101c28407d80f5e621305c6e770b9cd9f5c32603fe43e7309a7cf13b7fd26856e5

Download Submit
/usr/bin/hmprubylnr

Filesize
154KB

MD5
511ab46da4e85c82faf3ed60025ad936

SHA1
c1d01fa9171658d224629727e70b719645a1d9c5

SHA256
73171119ccd23b79d6e197ea12e25453ac8b0ec024c7fda248b2fdd233b072ae

SHA512
2dbf5a3cd730793b8c4889e864d1674cac55abc19c7232508f3711ede163503fb4b62716fcfc499bcbbf72f9a140d3ad5a1acb7df8f5a02bfbb26d5b762b8f75

Download Submit
/usr/bin/hmprubylnr

Filesize
596KB

MD5
ec82c87abda940a41cfea64770ea8bbd

SHA1
a33f18f720ed8acbd18367a031c24f924f21b8bf

SHA256
24d86bdf6c4a2540c3683871f5044a00cc0e13751501897abbe66dd139e9e8bf

SHA512
530cb60114ed34fa581b79c3e1b7502474fc95e22fb216b4fae4007b67bac54d9863bf3ab9d2c30a1c84d75b5184c856c04d2718707c80f83ae0ef08c4190d0b

Download Submit
/usr/bin/hmprubylnr

Filesize
596KB

MD5
2a4b1355221a3b4c306407c1dab1ec26

SHA1
f3048b79df4220510eeb017d58ba5ab989a8ac34

SHA256
952709d6aeb1777219dcd91743837ebbe52f8a3360c65e836281c1c23055be7e

SHA512
b5429789fb8904eccd4430281bd2a9a0c71345501af8703efc38f0fe7756e0364a95439af19e77444cfe56f81385f680ce4692f0a8ea2c1d15cc64c858539b0c

Download Submit
/usr/bin/ncgvlfouch

Filesize
596KB

MD5
724b5411072119735d511f66c00f9935

SHA1
49dcfb5e484eb3f6456f95db3b5708fcb841c24c

SHA256
4d51d989bb8de434af4294a9b908b874d5818af62030b6aadd0556630f668fac

SHA512
0f2f08a98f9a5a8731943448c66e6f10a6708c37944cb2b019528d70ebbc18067ce52750a0ea2b8a05ac77b2931ebc4d0d01766248956bc959b2e4b5a73939e3

Download Submit
/usr/bin/ncgvlfouch

Filesize
596KB

MD5
6ddd1027a43f10788c69e8a259e1d072

SHA1
e38d0005a5a3120e6331cbf0cef5d315164bebf4

SHA256
5d6a1b0aec5f889e8aaaa60129dc9e1a0c85fa3dde355a9f9f001f1178dd6ea6

SHA512
61d443342636501f4a995b23f443e59c24b8acdabacaaebab50d40190bdf1b78b30cdeb56be52a6338549844540aece9a93520b04f8ccb5fe1cff2dc75fbaac7

Download Submit
/usr/bin/nzvabqkwpm

Filesize
11KB

MD5
90c6c23b430d118ae7a64030f71e9f94

SHA1
4c85a43758bb10e47c6777b8c639303181a4822d

SHA256
0f5de2b8e954dceddad74ebed7625fccfaa3553fbf0b8afa301ca997c28f4d4f

SHA512
3e1fa55a4317ee2de6e50b729a2b401bf80c7924ff65352239760fb505c5406e250b24f6a2d315c44de85f52f9587ebe4c11f0beb99426ba52215286112bbb90

Download Submit
/usr/bin/xbsnokxptg

Filesize
596KB

MD5
4a3477ee5a050fcec1ef7aa815a182d8

SHA1
22fec3a63a6ebcd877958b77e92262c05913b023

SHA256
5fb63213774a9a757c676548e37c41d3bd1f86b6a7a4e535dd36c8c05448a54b

SHA512
e15ea188a043ae63d12c8bf7efb942218fc34b61757ed797a395f46243c981f1ff79839d972359462ad057450ad4dbd6d6ad91b05d3385cda1566f1c2c5451b4

Download Submit
/usr/bin/xbsnokxptg

Filesize
596KB

MD5
87ac535ce9ab0a43d5bdce47350b19ab

SHA1
cf78e309fa5759d2de98d8ad670a2f44f7698b76

SHA256
171fefbf729995da313ed1f7ad61ea5dc2bd45a55c5998429cf6b84d533467f7

SHA512
240f9e69daa63c80a126f3b32f8d030370eb3ae71eed1df3d3387b2532f290ef02f363851879ed1ddb8eb120a5f4542c5a13ae9641561d90620fbd25d607467d

Download Submit