Extracted

• • Target

    d1b5b4b4b5a118e384c7ff487e14ac3f

  • Size

    611KB

  • MD5

    d1b5b4b4b5a118e384c7ff487e14ac3f

  • SHA1

    038b7e9406fe5cb0a0be8f95ac935923c6d83c28

  • SHA256

    0a312a4154dcec2bc6ce1d3b51c037b122ace5848ec99c2b861ab6124addae9b

  • SHA512

    20885f782beeca1712924d6dec7fa474fb2fa7f926d7cbdbdd5f7fa18f6a3ac2bcd5dbd771a80c13c3403cbad05f2cda86ffefdc8170d6cc0f0b4b01a5baec74

  • SSDEEP

    12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6TiLx6yB1/iGK4UlUuTh1AG:UB1BVpmExDYp38X8LYTWhLfNiGQl/91h

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1