Extracted

• • Target

    2a91a3170a5fd4fb3e30f3d63b9120de

  • Size

    546KB

  • MD5

    2a91a3170a5fd4fb3e30f3d63b9120de

  • SHA1

    1a7a226833f43fdaee71cb6f84914f9a1e87de81

  • SHA256

    c9bd6d01eb7258fef88ec5c9276431c1db45f063b316f83943e45b6a40a76783

  • SHA512

    2d396f7fd0e661a2f15a1f0dc51341b89d9b28f6742a4bdfb7fe9115c5c7b44d9b8ac6e1c5e492f5971c2f9595f17c4154d979f7183df23d8f52ab0e24834d3f

  • SSDEEP

    12288:D3P1A0+Kvdnd4Asvhc27/ao+PzENGtkZg0/CedRlZRqR6ysen:Dfm0+KlZsJc27io2zYGtk20/LdF0+8

  Score

  10^/10

  xorddosbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Writes file to system bin folder

  behavioral1