xorddos | 76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882

Analysis

max time kernel
143s
max time network
154s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23-03-2024 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rgseznyhpumsr.elf
Size

549KB
MD5

455b46bf3f93b8853137de2b99ef0f4c
SHA1

99387d92aee1ad50c8af0a5192f651ad8021d1d4
SHA256

76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882
SHA512

a43cc62e55da2d23f2f57bffc3e2f3e406e41b0e1ba24b38d274a12e25d87d005f89f03e98c4fbf91622b75a4009c38033ea9d74316696469d26f9ea3a3237fa
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx6:VIv/qiVNHNDEfJKHZ8mG9QeeO6

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

bb.markerbio.com:13307

bb.myserv012.com:13307

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 16 IoCs

Processes:

resource	yara_rule
/tmp/fle.rsmuphynzesgr	family_xorddos
/bin/sczafxxhpnxda	family_xorddos
/bin/zwutnfzjjvw	family_xorddos
/bin/bktdamwbvy	family_xorddos
/bin/bivkib	family_xorddos
/bin/vnjydru	family_xorddos
/bin/cvhaqk	family_xorddos
/bin/oxbwvqfttxn	family_xorddos
/bin/cneehyfll	family_xorddos
/bin/zsqjacy	family_xorddos
/bin/bzfbkpmskcc	family_xorddos
/bin/kligsqvtda	family_xorddos
/bin/ybyeudnnujoswh	family_xorddos
/bin/bupzjvgsloebzo	family_xorddos
/bin/cixhuomgjwzsye	family_xorddos
/bin/tawlfr	family_xorddos

Deletes itself 64 IoCs

Processes:

pid
1545
1549
1552
1555
1558
1583
1582
1586
1589
1592
1595
1610
1613
1616
1619
1622
1625
1641
1644
1647
1650
1657
1660
1663
1666
1671
1674
1677
1680
1683
1686
1689
1692
1695
1698
1702
1705
1708
1711
1714
1717
1720
1723
1726
1729
1732
1735
1738
1741
1747
1750
1754
1757
1759
1763
1766
1769
1772
1778
1781
1784
1787
1792
1795

Executes dropped EXE 64 IoCs

Processes:

nlnexkbimcefdydmhaqpmsldrmzsczafxxhpnxdacnfkuolndzfwzmadbyfefzihzoeyxwoxvbkaaprfqyxxvewjlxjhfiyflzqiufooesqwjexjxkvwtkgcolsnveulmoscdvvmretrpsbmowwsaldsaazvnljfxwediyajuhkvejftnpjnytcfvqjrjgnpknkfkteujgwctlijhlhmgyxiemzqinczwutnfzjjvwdheqoswoqwxiwnqqikoefjhmsckphrvyowtgsqdaorsjalzescpzqidaxrtnyjjsbktdamwbvywdgauisclscylvjgxdvapepccqzagvfxaxpcijewghvlfbvcqyejxgptmeqbiqmrxxmauirhpnikbivkibdpivblduvrwjrsfbjmyvdpwnkvnjydrudxacutzdnricvhaqkoxbwvqfttxncneehyfllvbyqkyiwpwqurhckcbadplhwjpjwlhmzmmiicieudvdiigkojzzsxhjivqijuvzezijzsqjacybzfbkpmskcctyqtdqdomqwnknkpzvtyawkpibkjwfinalfdtvxgfkhrcgmhptrgbkligsqvtdaevubez

ioc	pid	process
/bin/nlnexkbi	1544	nlnexkbi
/bin/mcefdydm	1542	mcefdydm
/bin/haqpmsldrmz	1551	haqpmsldrmz
/bin/sczafxxhpnxda	1554	sczafxxhpnxda
/bin/cnfkuolndzf	1557	cnfkuolndzf
/bin/wzmadb	1581	wzmadb
/bin/yfefzihzoeyxw	1579	yfefzihzoeyxw
/bin/oxvbkaaprfqy	1585	oxvbkaaprfqy
/bin/xxvewjlxjh	1588	xxvewjlxjh
/bin/fiyflz	1591	fiyflz
/bin/qiufooesq	1609	qiufooesq
/bin/wjexjxkvwtkg	1612	wjexjxkvwtkg
/bin/colsnveulmoscd	1615	colsnveulmoscd
/bin/vvmretrpsbmow	1618	vvmretrpsbmow
/bin/wsaldsaazvnljf	1621	wsaldsaazvnljf
/bin/xwediyajuh	1640	xwediyajuh
/bin/kvejftnpjnytc	1643	kvejftnpjnytc
/bin/fvqjrjgnpk	1646	fvqjrjgnpk
/bin/nkfkteu	1649	nkfkteu
/bin/jgwctl	1652	jgwctl
/bin/ijhlhmg	1656	ijhlhmg
/bin/yxiemzqinc	1659	yxiemzqinc
/bin/zwutnfzjjvw	1662	zwutnfzjjvw
/bin/dheqoswoq	1665	dheqoswoq
/bin/wxiwnq	1668	wxiwnq
/bin/qikoef	1670	qikoef
/bin/jhmsckphrvy	1673	jhmsckphrvy
/bin/owtgsqdaors	1676	owtgsqdaors
/bin/jalzescpzqidax	1679	jalzescpzqidax
/bin/rtnyjjs	1682	rtnyjjs
/bin/bktdamwbvy	1685	bktdamwbvy
/bin/wdgauisclscylv	1688	wdgauisclscylv
/bin/jgxdvap	1691	jgxdvap
/bin/epccqzagvf	1694	epccqzagvf
/bin/xaxpcije	1697	xaxpcije
/bin/wghvlf	1701	wghvlf
/bin/bvcqyejxgptmeq	1704	bvcqyejxgptmeq
/bin/biqmrxxma	1707	biqmrxxma
/bin/uirhpnik	1710	uirhpnik
/bin/bivkib	1713	bivkib
/bin/dpivbldu	1716	dpivbldu
/bin/vrwjrsfbjm	1719	vrwjrsfbjm
/bin/yvdpwnk	1722	yvdpwnk
/bin/vnjydru	1725	vnjydru
/bin/dxacutzdnri	1728	dxacutzdnri
/bin/cvhaqk	1731	cvhaqk
/bin/oxbwvqfttxn	1734	oxbwvqfttxn
/bin/cneehyfll	1737	cneehyfll
/bin/vbyqkyiwp	1740	vbyqkyiwp
/bin/wqurhckcba	1743	wqurhckcba
/bin/dplhwjpjwlh	1746	dplhwjpjwlh
/bin/mzmmiicieudvd	1749	mzmmiicieudvd
/bin/iigkojzzsx	1752	iigkojzzsx
/bin/hjivqij	1755	hjivqij
/bin/uvzezij	1758	uvzezij
/bin/zsqjacy	1762	zsqjacy
/bin/bzfbkpmskcc	1765	bzfbkpmskcc
/bin/tyqtdqdomqwnkn	1768	tyqtdqdomqwnkn
/bin/kpzvtyawkpi	1771	kpzvtyawkpi
/bin/bkjwfinalfd	1774	bkjwfinalfd
/bin/tvxgfkhrcgm	1777	tvxgfkhrcgm
/bin/hptrgb	1780	hptrgb
/bin/kligsqvtda	1783	kligsqvtda
/bin/evubez	1786	evubez

Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

description ioc

File opened for modification /etc/cron.hourly/fle.rsmuphynzesgr.sh
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

File opened for reading /proc/net/tcp
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/fle.rsmuphynzesgr

description	ioc
File opened for modification	/etc/cron.hourly/fle.rsmuphynzesgr.sh

description	ioc
File opened for reading	/proc/net/tcp

description	ioc
File opened for modification	/etc/init.d/fle.rsmuphynzesgr

Writes file to system bin folder 1 TTPs 64 IoCs

Hijack Execution Flow

T1574

Processes:

description	ioc
File opened for modification	/bin/vvmretrpsbmow
File opened for modification	/bin/zwutnfzjjvw
File opened for modification	/bin/epccqzagvf
File opened for modification	/bin/xaxpcije
File opened for modification	/bin/tvxgfkhrcgm
File opened for modification	/bin/ondmqdoa
File opened for modification	/bin/uirhpnik
File opened for modification	/bin/vnjydru
File opened for modification	/bin/dxacutzdnri
File opened for modification	/bin/dplhwjpjwlh
File opened for modification	/bin/tyqtdqdomqwnkn
File opened for modification	/bin/edhyndi
File opened for modification	/bin/pmhdfkpels
File opened for modification	/bin/fvqjrjgnpk
File opened for modification	/bin/bktdamwbvy
File opened for modification	/bin/fhphjojkufp
File opened for modification	/bin/mcefdydm
File opened for modification	/bin/xxvewjlxjh
File opened for modification	/bin/bkjwfinalfd
File opened for modification	/bin/beiorj
File opened for modification	/bin/tawlfr
File opened for modification	/bin/wxiwnq
File opened for modification	/bin/qikoef
File opened for modification	/bin/bvcqyejxgptmeq
File opened for modification	/bin/hjivqij
File opened for modification	/bin/bzfbkpmskcc
File opened for modification	/bin/ltqsfnzwgsfhr
File opened for modification	/bin/jqefpkzmqbmx
File opened for modification	/bin/thzfvtuhpet
File opened for modification	/bin/hzyvhjrhbrnqlq
File opened for modification	/bin/rtnyjjs
File opened for modification	/bin/vbyqkyiwp
File opened for modification	/bin/colsnveulmoscd
File opened for modification	/bin/xwediyajuh
File opened for modification	/bin/yxiemzqinc
File opened for modification	/bin/biqmrxxma
File opened for modification	/bin/dpivbldu
File opened for modification	/bin/iigkojzzsx
File opened for modification	/bin/kligsqvtda
File opened for modification	/bin/ubxmrthwvgcra
File opened for modification	/bin/oxvbkaaprfqy
File opened for modification	/bin/jhmsckphrvy
File opened for modification	/bin/wqurhckcba
File opened for modification	/bin/mzmmiicieudvd
File opened for modification	/bin/zsqjacy
File opened for modification	/bin/hptrgb
File opened for modification	/bin/sczafxxhpnxda
File opened for modification	/bin/nkfkteu
File opened for modification	/bin/jgwctl
File opened for modification	/bin/wdgauisclscylv
File opened for modification	/bin/yvdpwnk
File opened for modification	/bin/evubez
File opened for modification	/bin/ybyeudnnujoswh
File opened for modification	/bin/vekhunvvkxf
File opened for modification	/bin/yfefzihzoeyxw
File opened for modification	/bin/wzmadb
File opened for modification	/bin/dheqoswoq
File opened for modification	/bin/owtgsqdaors
File opened for modification	/bin/uvzezij
File opened for modification	/bin/uzgrvecafy
File opened for modification	/bin/nlnexkbi
File opened for modification	/bin/haqpmsldrmz
File opened for modification	/bin/jgxdvap
File opened for modification	/bin/ehllzybfzatygz

Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/tcp

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/557/fd
File opened for reading	/proc/1031/fd
File opened for reading	/proc/1162/fd
File opened for reading	/proc/1330/fd
File opened for reading	/proc/1308/fd
File opened for reading	/proc/464/fd
File opened for reading	/proc/1598/fd
File opened for reading	/proc/1604/fd
File opened for reading	/proc/1136/fd
File opened for reading	/proc/607/fd
File opened for reading	/proc/715/fd
File opened for reading	/proc/1085/fd
File opened for reading	/proc/1164/fd
File opened for reading	/proc/1527/fd
File opened for reading	/proc/475/fd
File opened for reading	/proc/960/fd
File opened for reading	/proc/1082/fd
File opened for reading	/proc/1754/fd
File opened for reading	/proc/stat
File opened for reading	/proc/1128/fd
File opened for reading	/proc/1161/fd
File opened for reading	/proc/1634/fd
File opened for reading	/proc/1175/fd
File opened for reading	/proc/1279/fd
File opened for reading	/proc/686/fd
File opened for reading	/proc/1631/fd
File opened for reading	/proc/1747/fd
File opened for reading	/proc/1056/fd
File opened for reading	/proc/1094/fd
File opened for reading	/proc/1625/fd
File opened for reading	/proc/921/fd
File opened for reading	/proc/964/fd
File opened for reading	/proc/1168/fd
File opened for reading	/proc/1595/fd
File opened for reading	/proc/443/fd
File opened for reading	/proc/1446/fd
File opened for reading	/proc/608/fd
File opened for reading	/proc/685/fd
File opened for reading	/proc/1036/fd
File opened for reading	/proc/1314/fd
File opened for reading	/proc/1350/fd
File opened for reading	/proc/1301/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/274/fd
File opened for reading	/proc/540/fd
File opened for reading	/proc/533/fd
File opened for reading	/proc/693/fd
File opened for reading	/proc/441/fd
File opened for reading	/proc/449/fd
File opened for reading	/proc/522/fd
File opened for reading	/proc/1179/fd
File opened for reading	/proc/1257/fd
File opened for reading	/proc/431/fd
File opened for reading	/proc/446/fd
File opened for reading	/proc/1080/fd
File opened for reading	/proc/578/fd
File opened for reading	/proc/1630/fd
File opened for reading	/proc/1071/fd
File opened for reading	/proc/1206/fd
File opened for reading	/proc/1367/fd
File opened for reading	/proc/491/fd
File opened for reading	/proc/1144/fd
File opened for reading	/proc/1757/fd
File opened for reading	/proc/1202/fd

Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes:

description ioc

File opened for modification /dev/shm/sem.a6dsJk
File opened for modification /dev/shm/sem.fqzcwy
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

description ioc

File opened for modification /tmp/fle.rsmuphynzesgr
File opened for modification /tmp/fle.rsmuphynzesgr.sh

description	ioc
File opened for modification	/dev/shm/sem.a6dsJk
File opened for modification	/dev/shm/sem.fqzcwy

description	ioc
File opened for modification	/tmp/fle.rsmuphynzesgr
File opened for modification	/tmp/fle.rsmuphynzesgr.sh

/tmp/rgseznyhpumsr.elf
/tmp/rgseznyhpumsr.elf
1⤵
PID:1537

/bin/nlnexkbi
/bin/nlnexkbi -d 1538
1⤵
- Executes dropped EXE
PID:1544

/bin/mcefdydm
/bin/mcefdydm -d 1538
1⤵
- Executes dropped EXE
PID:1542

/bin/haqpmsldrmz
/bin/haqpmsldrmz -d 1538
1⤵
- Executes dropped EXE
PID:1551

/bin/sczafxxhpnxda
/bin/sczafxxhpnxda -d 1538
1⤵
- Executes dropped EXE
PID:1554

/bin/cnfkuolndzf
/bin/cnfkuolndzf -d 1538
1⤵
- Executes dropped EXE
PID:1557

/bin/wzmadb
/bin/wzmadb -d 1538
1⤵
- Executes dropped EXE
PID:1581

/bin/yfefzihzoeyxw
/bin/yfefzihzoeyxw -d 1538
1⤵
- Executes dropped EXE
PID:1579

/bin/oxvbkaaprfqy
/bin/oxvbkaaprfqy -d 1538
1⤵
- Executes dropped EXE
PID:1585

/bin/xxvewjlxjh
/bin/xxvewjlxjh -d 1538
1⤵
- Executes dropped EXE
PID:1588

/bin/fiyflz
/bin/fiyflz -d 1538
1⤵
- Executes dropped EXE
PID:1591

/bin/qiufooesq
/bin/qiufooesq -d 1538
1⤵
- Executes dropped EXE
PID:1609

/bin/wjexjxkvwtkg
/bin/wjexjxkvwtkg -d 1538
1⤵
- Executes dropped EXE
PID:1612

/bin/colsnveulmoscd
/bin/colsnveulmoscd -d 1538
1⤵
- Executes dropped EXE
PID:1615

/bin/vvmretrpsbmow
/bin/vvmretrpsbmow -d 1538
1⤵
- Executes dropped EXE
PID:1618

/bin/wsaldsaazvnljf
/bin/wsaldsaazvnljf -d 1538
1⤵
- Executes dropped EXE
PID:1621

/bin/xwediyajuh
/bin/xwediyajuh -d 1538
1⤵
- Executes dropped EXE
PID:1640

/bin/kvejftnpjnytc
/bin/kvejftnpjnytc -d 1538
1⤵
- Executes dropped EXE
PID:1643

/bin/fvqjrjgnpk
/bin/fvqjrjgnpk -d 1538
1⤵
- Executes dropped EXE
PID:1646

/bin/nkfkteu
/bin/nkfkteu -d 1538
1⤵
- Executes dropped EXE
PID:1649

/bin/jgwctl
/bin/jgwctl -d 1538
1⤵
- Executes dropped EXE
PID:1652

/bin/ijhlhmg
/bin/ijhlhmg -d 1538
1⤵
- Executes dropped EXE
PID:1656

/bin/yxiemzqinc
/bin/yxiemzqinc -d 1538
1⤵
- Executes dropped EXE
PID:1659

/bin/zwutnfzjjvw
/bin/zwutnfzjjvw -d 1538
1⤵
- Executes dropped EXE
PID:1662

/bin/dheqoswoq
/bin/dheqoswoq -d 1538
1⤵
- Executes dropped EXE
PID:1665

/bin/wxiwnq
/bin/wxiwnq -d 1538
1⤵
- Executes dropped EXE
PID:1668

/bin/qikoef
/bin/qikoef -d 1538
1⤵
- Executes dropped EXE
PID:1670

/bin/jhmsckphrvy
/bin/jhmsckphrvy -d 1538
1⤵
- Executes dropped EXE
PID:1673

/bin/owtgsqdaors
/bin/owtgsqdaors -d 1538
1⤵
- Executes dropped EXE
PID:1676

/bin/jalzescpzqidax
/bin/jalzescpzqidax -d 1538
1⤵
- Executes dropped EXE
PID:1679

/bin/rtnyjjs
/bin/rtnyjjs -d 1538
1⤵
- Executes dropped EXE
PID:1682

/bin/bktdamwbvy
/bin/bktdamwbvy -d 1538
1⤵
- Executes dropped EXE
PID:1685

/bin/wdgauisclscylv
/bin/wdgauisclscylv -d 1538
1⤵
- Executes dropped EXE
PID:1688

/bin/jgxdvap
/bin/jgxdvap -d 1538
1⤵
- Executes dropped EXE
PID:1691

/bin/epccqzagvf
/bin/epccqzagvf -d 1538
1⤵
- Executes dropped EXE
PID:1694

/bin/xaxpcije
/bin/xaxpcije -d 1538
1⤵
- Executes dropped EXE
PID:1697

/bin/wghvlf
/bin/wghvlf -d 1538
1⤵
- Executes dropped EXE
PID:1701

/bin/bvcqyejxgptmeq
/bin/bvcqyejxgptmeq -d 1538
1⤵
- Executes dropped EXE
PID:1704

/bin/biqmrxxma
/bin/biqmrxxma -d 1538
1⤵
- Executes dropped EXE
PID:1707

/bin/uirhpnik
/bin/uirhpnik -d 1538
1⤵
- Executes dropped EXE
PID:1710

/bin/bivkib
/bin/bivkib -d 1538
1⤵
- Executes dropped EXE
PID:1713

/bin/dpivbldu
/bin/dpivbldu -d 1538
1⤵
- Executes dropped EXE
PID:1716

/bin/vrwjrsfbjm
/bin/vrwjrsfbjm -d 1538
1⤵
- Executes dropped EXE
PID:1719

/bin/yvdpwnk
/bin/yvdpwnk -d 1538
1⤵
- Executes dropped EXE
PID:1722

/bin/vnjydru
/bin/vnjydru -d 1538
1⤵
- Executes dropped EXE
PID:1725

/bin/dxacutzdnri
/bin/dxacutzdnri -d 1538
1⤵
- Executes dropped EXE
PID:1728

/bin/cvhaqk
/bin/cvhaqk -d 1538
1⤵
- Executes dropped EXE
PID:1731

/bin/oxbwvqfttxn
/bin/oxbwvqfttxn -d 1538
1⤵
- Executes dropped EXE
PID:1734

/bin/cneehyfll
/bin/cneehyfll -d 1538
1⤵
- Executes dropped EXE
PID:1737

/bin/vbyqkyiwp
/bin/vbyqkyiwp -d 1538
1⤵
- Executes dropped EXE
PID:1740

/bin/wqurhckcba
/bin/wqurhckcba -d 1538
1⤵
- Executes dropped EXE
PID:1743

/bin/dplhwjpjwlh
/bin/dplhwjpjwlh -d 1538
1⤵
- Executes dropped EXE
PID:1746

/bin/mzmmiicieudvd
/bin/mzmmiicieudvd -d 1538
1⤵
- Executes dropped EXE
PID:1749

/bin/iigkojzzsx
/bin/iigkojzzsx -d 1538
1⤵
- Executes dropped EXE
PID:1752

/bin/hjivqij
/bin/hjivqij -d 1538
1⤵
- Executes dropped EXE
PID:1755

/bin/uvzezij
/bin/uvzezij -d 1538
1⤵
- Executes dropped EXE
PID:1758

/bin/zsqjacy
/bin/zsqjacy -d 1538
1⤵
- Executes dropped EXE
PID:1762

/bin/bzfbkpmskcc
/bin/bzfbkpmskcc -d 1538
1⤵
- Executes dropped EXE
PID:1765

/bin/tyqtdqdomqwnkn
/bin/tyqtdqdomqwnkn -d 1538
1⤵
- Executes dropped EXE
PID:1768

/bin/kpzvtyawkpi
/bin/kpzvtyawkpi -d 1538
1⤵
- Executes dropped EXE
PID:1771

/bin/bkjwfinalfd
/bin/bkjwfinalfd -d 1538
1⤵
- Executes dropped EXE
PID:1774

/bin/tvxgfkhrcgm
/bin/tvxgfkhrcgm -d 1538
1⤵
- Executes dropped EXE
PID:1777

/bin/hptrgb
/bin/hptrgb -d 1538
1⤵
- Executes dropped EXE
PID:1780

/bin/kligsqvtda
/bin/kligsqvtda -d 1538
1⤵
- Executes dropped EXE
PID:1783

/bin/evubez
/bin/evubez -d 1538
1⤵
- Executes dropped EXE
PID:1786

/bin/ltqsfnzwgsfhr
/bin/ltqsfnzwgsfhr -d 1538
1⤵
PID:1789

/bin/ubxmrthwvgcra
/bin/ubxmrthwvgcra -d 1538
1⤵
PID:1791

/bin/vbtguja
/bin/vbtguja -d 1538
1⤵
PID:1794

/bin/ybyeudnnujoswh
/bin/ybyeudnnujoswh -d 1538
1⤵
PID:1797

/bin/ffilhblkyn
/bin/ffilhblkyn -d 1538
1⤵
PID:1800

/bin/fhphjojkufp
/bin/fhphjojkufp -d 1538
1⤵
PID:1803

/bin/ukticrrpxwxi
/bin/ukticrrpxwxi -d 1538
1⤵
PID:1806

/bin/bupzjvgsloebzo
/bin/bupzjvgsloebzo -d 1538
1⤵
PID:1809

/bin/edhyndi
/bin/edhyndi -d 1538
1⤵
PID:1812

/bin/uzgrvecafy
/bin/uzgrvecafy -d 1538
1⤵
PID:1815

/bin/ehllzybfzatygz
/bin/ehllzybfzatygz -d 1538
1⤵
PID:1818

/bin/jqefpkzmqbmx
/bin/jqefpkzmqbmx -d 1538
1⤵
PID:1822

/bin/beiorj
/bin/beiorj -d 1538
1⤵
PID:1825

/bin/spluikchskwdac
/bin/spluikchskwdac -d 1538
1⤵
PID:1828

/bin/pmhdfkpels
/bin/pmhdfkpels -d 1538
1⤵
PID:1831

/bin/thzfvtuhpet
/bin/thzfvtuhpet -d 1538
1⤵
PID:1834

/bin/ondmqdoa
/bin/ondmqdoa -d 1538
1⤵
PID:1837

/bin/cixhuomgjwzsye
/bin/cixhuomgjwzsye -d 1538
1⤵
PID:1840

/bin/tawlfr
/bin/tawlfr -d 1538
1⤵
PID:1843

/bin/vekhunvvkxf
/bin/vekhunvvkxf -d 1538
1⤵
PID:1846

/bin/hzyvhjrhbrnqlq
/bin/hzyvhjrhbrnqlq -d 1538
1⤵
PID:1849

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/bivkib

Filesize
262KB

MD5
bff4dc67c313a647de45eb16c754d572

SHA1
2111c32cdc46f84fab4e8f4a8edde19e44549f54

SHA256
4f599930eefb03a3271a9837f0f1ab376aac10b1f92eb25f6afae9a82985b677

SHA512
0e8d13e01010cf11686576a977619b2b1146361a897ed2c46ece6d630584021d55a692cea1356de6ff5713ec654d7c40e54adbd0e8313a267e0f78c2c8815fb6

Download Submit
/bin/bktdamwbvy

Filesize
248KB

MD5
ab5607b2cad3e314abbb63c99d635f61

SHA1
b1f00feb280199f747cd3c49ac3a13db27c9bda8

SHA256
27e5fec3db833278ff4e6148aaa8cdf8b7f359b3752b5b40655fe744b9521281

SHA512
fda48770fdf1bd14474389a551777616490626539d76552071fa55b3e20d4d6eed4a2294ed1b5eebce565d075577aa401dc3a03189b73b8cde72bfe82cc220b7

Download Submit
/bin/bupzjvgsloebzo

Filesize
312KB

MD5
2da845e1bc6df13c8ad6ecd1da0375a5

SHA1
a629277fe29982476600f045bb90322eeb9c13b5

SHA256
286c3a9c635a607797fef8bd4cb46ff2816dcd6550d61b2b9c525c1e10f28da3

SHA512
328213d7baa7c435011ee838ea09b62689078cce426d9524c92a77572512f858df7fca25c156e688067abd65449046a112d691ece0859c870bf92a69495ab13d

Download Submit
/bin/bzfbkpmskcc

Filesize
72KB

MD5
9dce079c6c6d270d1c030b9086660d99

SHA1
25748833fbe1c0807630ebeaf8eb6a0d6e4a2494

SHA256
884228fc0f723cc85a43b1b10566060790e941b4dcba01663ff05e092bafb6c0

SHA512
719c6da219d7e5fa0b456148ad8d6f217c6a9a99b6ca919b85c9d9e2a5ad6972d3203a2a36f62858db12d0da20c1264ffa27d30d228f43a2a63df9e2b0f1d738

Download Submit
/bin/cixhuomgjwzsye

Filesize
244KB

MD5
d631fce3994c1f3c3b9c1c8f959bc865

SHA1
9a3bde040ad1670790c3d1713207880ac6aa5484

SHA256
2e469302434dbf2ec50cef637f8a586c2a1b0f95e0840eb9f2bbde3d4ebd8075

SHA512
a8a9fca754687c65e6a8c27c86b9be12df3880f7d62cf47e845c748e1ff86f85cf972a00fa8f1fac6bac8661bfff6950b47777c76b6bb36752fddc7dce691b3a

Download Submit
/bin/cneehyfll

Filesize
48KB

MD5
8fee028be0257012e30931650eee8a9f

SHA1
d3fe0f57b5664390925956805633eaaaf4a32707

SHA256
e26a45c5bf1f746ff465a5b6d53a6b9cd096b469822f9650f7e139845126c360

SHA512
c6838403bfc397f8328646db4ee95c65350de67454a78334956d5941afac256ac3133094cf2a51ab12497fc39b7da3f9d6302cc9e81463e8d66675346987aa3b

Download Submit
/bin/cvhaqk

Filesize
384KB

MD5
0b907d549e41f9a9ce2e960202ed1667

SHA1
9eab7a42dff45dff0d5391c54f0d806beffa204e

SHA256
52cb47d8a4c8addc878d1c0ea9246013af438b0eae9a76dc5447406323c35044

SHA512
1ba203e27b98efd520138257bd290588b8e11ba327efe5c660bfbf1af4dc057a2996040980fbb8e5702a8bed2587eda15c6e8df64e981af544e9375d28b20534

Download Submit
/bin/kligsqvtda

Filesize
348KB

MD5
f82e85913dc2ca27fb158bee6dd669bc

SHA1
61598d914e18d4174fd32c718feebefb5e6e440e

SHA256
d36cdd643a1c3a7c99f8ace695927ff5aa8b5f5a294d4cb2dfd2c3602c67e4a5

SHA512
3a22b5a0fbf2ef1aaec6e6f9aaef24b743571a09e3e6b47821453634165f1e84237c0872d589e5d9ac19723e523506961b6c956d77cbccb15ddc76d5f72f4e59

Download Submit
/bin/oxbwvqfttxn

Filesize
276KB

MD5
b86103989e6f0ad5bee4c2f934eaaa32

SHA1
a0dc9b4db5509c61e1be94fbf1d12a320451f7df

SHA256
b39633ff1928c7f548c6a27ef4265cfd2c380230896b85f432ff15c7c819032c

SHA512
fa2468ac87a1f49cc954a907f847ff92bbfe77a2cf5b7ecfa646a8509998c148b081607b7f74e57cd35e9a3c759e6ca6a674e490131187c3b23e55a60b7fb6ab

Download Submit
/bin/sczafxxhpnxda

Filesize
75KB

MD5
1bf1d4cdff757c94a42367d26837caf6

SHA1
fae4d021bac63dbcdb5b25381850635af4b6b64a

SHA256
581aa302cf78adc84acf44abdb2c94e60cb617bef244451a3455132f9844c16c

SHA512
04fdb357c0683fbe2190bd85c99f0cf69977d7c2106fa60a105f192e4ff0d8cd756e47e7718406722b504324195fe6b67bce5274f114fdc1a5a63798137ce5b2

Download Submit
/bin/tawlfr

Filesize
508KB

MD5
77dd7c2731f74114277e1113da648f4c

SHA1
91b1f5ded38247adf514d0e5045a58c46953fdb2

SHA256
51e2c44ddf7512f8f1d25f5edeb811b4bcc64ce1d3d9498b3b58c6a0291596f5

SHA512
dbc42e1bc7a8f6dce291e3352e8ebafe6ef0a3d6aba9872c1658d312005c686e4f7f0da341cec8e46d05b7fe58230b0bf7982dd359b07b362a9044c78241efcf

Download Submit
/bin/vnjydru

Filesize
340KB

MD5
b4a8c4c3e373d01fe87729a509ef0fab

SHA1
58fdb08e180c73dce9e08004dc63e39e91bd68bf

SHA256
a523a74b2e400ff664cd9967cad7672e72ff5c475f1777c0b8b1d98d5f0ed819

SHA512
6a360e2dc17c3c77c21da014dd7230d395d7b55a765f185c890b0b933623bce7776841b477d37fbdb302012d888a546d7a58966a461012375d30036b453aa17d

Download Submit
/bin/ybyeudnnujoswh

Filesize
320KB

MD5
46e51f1ead314a67b86e11774eac4e25

SHA1
74f6c290058679e2921bbc0dd3c2b5f7a1945306

SHA256
41a5c5bb92b80e7a8c4ff8094b9a1799732a780233bd1b15244e5e9937d8d7c6

SHA512
67fcc8c4b8f403c7389892b91e6e961170325da8843d49e7634fec1f19fafc667f526f8e9b7a741c703dbd548c46fc2d6f9b9d9d650417f1f1f99dbcc675982b

Download Submit
/bin/zsqjacy

Filesize
24KB

MD5
88a9738a40716b41142b7c9a2c42aa9c

SHA1
09190b3d64224d9694ba3d2e7358d49d1ef7e74e

SHA256
8a3defdf6ec53bf042b9f624a13d85cc4bb4bb04eee41ab63c495b0022c92516

SHA512
e041519fb232afecfda1cd3fa16b8f83ca5a0ea9b44b3b4bb7f13a14c3ef25ae5e6bd401c2041788229950c029c071cd915a4c1713daac4031d48d85cdd9538d

Download Submit
/bin/zwutnfzjjvw

Filesize
268KB

MD5
540c2c76f9fdc87fec8e83d70b14cf4b

SHA1
3d470487e941f0357df95969540c1cc65220f9e5

SHA256
1b460d576785ba55b972c2067f7014cb26f5f4ff23a26f9816d4ad3adcb67fb8

SHA512
960c2de72914adfc2abe09e3b4c17c4ec42ab99dc31cf9bbaa77a0687d03dcb617311f060f172b5cfbab21451478bd759cc3cb5d633604235e1d5aa065957820

Download Submit
/etc/cron.hourly/fle.rsmuphynzesgr.sh

Filesize
154B

MD5
4a491c8e8e46c4c7604b9d7a31ba9f76

SHA1
b514221fd6e60ef3a1a572ca4a649844838d5ab5

SHA256
d96cd46d65b18deac06402f0a4f9444f5b1ea1964afc1ef33fc356438f6964b3

SHA512
c5b6e9379c52b3c9418ca233df2c764a311b0f3619f65359e65a84b7a4e4556d16d4865676f8f715d616b6ad317e94cf6222f9eefcbb5ccfd60a7b097ea95b7e

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
74c4552ecb067384faebe9a8e81c92d6

SHA1
375ea67dc9c4495ea38aebedb918f49b0d8c6a84

SHA256
4435e21c30aec8bff430e7b9c89cc154b710f608579456931ff59dcb35fa50c7

SHA512
2f8c76b581daa86805342b2fb98682afa6e314a30a09924f5b3276ead0937f047f05515f9abe6b2aa785ceb4a74f680d95c012ef7718d3fbb67ad2cd6b861551

Download Submit
/etc/init.d/fle.rsmuphynzesgr

Filesize
373B

MD5
521cea07b0f39cfb0f80c34551cae4cf

SHA1
45efe3a8f350e8f3dc1daeee9a73fc39a3a84622

SHA256
7e6002ebf58642a141bb6a9f2e715c18986abcb536897f56f01f853df61569ca

SHA512
e15305143a351d7e7c210e4efaacbccf1ec65917e1076b79101aa18faf3ec5e4880e0c8ee1ac48099a59ae5119965acd8588ba21926f47f5d075fcdd22645f3b

Download Submit
/tmp/fle.rsmuphynzesgr

Filesize
549KB

MD5
455b46bf3f93b8853137de2b99ef0f4c

SHA1
99387d92aee1ad50c8af0a5192f651ad8021d1d4

SHA256
76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882

SHA512
a43cc62e55da2d23f2f57bffc3e2f3e406e41b0e1ba24b38d274a12e25d87d005f89f03e98c4fbf91622b75a4009c38033ea9d74316696469d26f9ea3a3237fa

Download Submit