Analysis
-
max time kernel
153s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
31-12-2023 01:34
General
-
Target
112
-
Size
549KB
-
MD5
f9191bab1e834d4aef3380700639cee9
-
SHA1
9c20269df6694260a24ac783de2e30d627a6928a
-
SHA256
ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73
-
SHA512
3d2758fe2d06183e627b5cc24919c08c84108f2efd7ab0a162029d55537476410d9535d50f3eb059f7153f7482c134284862eea121201f82838aace4b12283b5
-
SSDEEP
12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO
Malware Config
Extracted
xorddos
api.markerbio.com:112
api.enoan2107.com:112
http://qq.com/lib.asp
-
crc_polynomial
CDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 4 IoCs
-
Deletes itself 25 IoCs
-
Executes dropped EXE 26 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Writes file to system bin folder 1 TTPs 29 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
Processes
-
/tmp/112/tmp/1121⤵
-
/bin/bsqwwn/bin/bsqwwn1⤵
- Executes dropped EXE
-
/bin/rjfazl/bin/rjfazl -d 15801⤵
- Executes dropped EXE
-
/bin/hmrrii/bin/hmrrii -d 15801⤵
- Executes dropped EXE
-
/bin/mtelrfpipk/bin/mtelrfpipk -d 15801⤵
- Executes dropped EXE
-
/bin/zgbyxcwa/bin/zgbyxcwa -d 15801⤵
- Executes dropped EXE
-
/bin/xkegwxzggxsz/bin/xkegwxzggxsz -d 15801⤵
- Executes dropped EXE
-
/bin/skuczhxzgfaede/bin/skuczhxzgfaede -d 15801⤵
- Executes dropped EXE
-
/bin/fbzphho/bin/fbzphho -d 15801⤵
- Executes dropped EXE
-
/bin/gwngpojwiutkt/bin/gwngpojwiutkt -d 15801⤵
- Executes dropped EXE
-
/bin/jugpxn/bin/jugpxn -d 15801⤵
- Executes dropped EXE
-
/bin/drxftpmadthb/bin/drxftpmadthb -d 15801⤵
- Executes dropped EXE
-
/bin/yiqnhfhlxgsqvg/bin/yiqnhfhlxgsqvg -d 15801⤵
- Executes dropped EXE
-
/bin/aabciqufp/bin/aabciqufp -d 15801⤵
- Executes dropped EXE
-
/bin/jhtatbaeuplz/bin/jhtatbaeuplz -d 15801⤵
- Executes dropped EXE
-
/bin/ywcsoazha/bin/ywcsoazha -d 15801⤵
- Executes dropped EXE
-
/bin/kelbzsqkexeet/bin/kelbzsqkexeet -d 15801⤵
- Executes dropped EXE
-
/bin/qvgzyhjcv/bin/qvgzyhjcv -d 15801⤵
- Executes dropped EXE
-
/bin/bnaorasxt/bin/bnaorasxt -d 15801⤵
- Executes dropped EXE
-
/bin/dsdyeerpf/bin/dsdyeerpf -d 15801⤵
- Executes dropped EXE
-
/bin/xvkdwinglis/bin/xvkdwinglis -d 15801⤵
- Executes dropped EXE
-
/bin/xtcpvwmoysib/bin/xtcpvwmoysib -d 15801⤵
- Executes dropped EXE
-
/bin/stmfbh/bin/stmfbh -d 15801⤵
- Executes dropped EXE
-
/bin/zaaqxwel/bin/zaaqxwel -d 15801⤵
- Executes dropped EXE
-
/bin/wtxphe/bin/wtxphe -d 15801⤵
- Executes dropped EXE
-
/bin/lryodh/bin/lryodh -d 15801⤵
- Executes dropped EXE
-
/bin/jboyis/bin/jboyis -d 15801⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
549KB
MD5f32b06bf383643a2f09c4aab347f1bcf
SHA1162aa3a908f5efe5f959f796cb126d1aeff31132
SHA256d8af3d557c6bbb44d674c371a1ca27d92a0ddfc2d667725e968af84baab6ded7
SHA512ab793d118be2b0d4ad98ef4c430818b0fbf2bd59e23129eb64b4435ee13031c48064b79e703d55b402d55c7f9c3ca5671156d390b0982e2e38642c0ec07da120
-
Filesize
164KB
MD50504ae8fd4ca3d8fe6ca42d60d4df206
SHA1006d08db84a8caef3c25ec7367849d2467e7f319
SHA2567cb7c53ce727697e19e475997c709f1c91c380109445b4fdb785776e8acbdc39
SHA5127394091d788a8ee2e1d8f7799006185671b5bc491eec844deb476ea7ff2dbba86e4eb07affb10f9db919e0e3f571485682a78a6668af9cd5e272c42d3db5a128
-
Filesize
396KB
MD55d5e1934b75b47fd4d3ba04c331869c3
SHA147264ac1824d25c17e428177ac6c47c4568c74d9
SHA256cc42731bf94ff321ee0d9c9085dde80e2ee5268d571b98594eafc5c799113cd5
SHA512b2fe021a800f3dfc71df045ae95e2cf46636c844eb80a97c95239827ae4d5d62431a5cd4bb5e4b7899a366d7b3ede1641177cae4610cb4855e5a5bd2aff59b7a
-
Filesize
39KB
MD57a9c78aac853767710958b5a50343453
SHA17758c902ec9d0ce482d9951c5df1231552e2a04a
SHA2569300434d60e31bbb3f5001584e60e310428cba604b824a3ef657c24494b649de
SHA512b142c83afe86b17cf04be2b439b1248e86ef23717d658c20a368bfbd797012b8560ef1ced744c5e4b1f166515c0e087dabeec4cb57ad8d1a85449105bb0af851
-
Filesize
143B
MD5002112a115bfa34c01c76bc872c10123
SHA17d0c4e09c897b4757d54d3c5155a307841b0e6a1
SHA2568e64bdc45bf6b6ba8ea1c2549157bdd8b9b96d82c9ab4840a7be0ffd99193a0f
SHA51289f257e235d96274120af07d9a0e29db4e63c92d457cc233505de612588d51e3996d87f13bec257a45e1100a0acd90b3d8000e615506fa926011d6dd7e07f0db
-
Filesize
32B
MD523690b70bbf6fd87c0188630896df32d
SHA1943f9a620b85d2c64b914ed5139f9756d1d01217
SHA2565e2612bd16344df8140e0f97dc36f7ddfa7deabd1f0c6e35c7b142719102cb22
SHA51297d681d3ea378f95e212cfac618bd690f28f2bf747dac659101c46656020b3a9defdfb49aab3c7dc5b25f822c537250829836f116d5aef715e5ad67e2fac2592
-
Filesize
318B
MD5d383903eae4d850d02758aac9f225d2d
SHA1b3d7c924725b6aba3da43d96e70e103fa7704117
SHA256c3f0e583b5f53a7e8e19cb2ee9194dcbcfe457c8707624e4515227c748a006d3
SHA512ab92fc57c11257f71162602a5600d8855925763281a820d156df61ba6be72d4928aed6d09da10dafd0ef7837d7aa8d31ec38fb809231b387d8ff11d7df963bca