xorddos | 76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882

General

Target

76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882.elf
Size

549KB
MD5

455b46bf3f93b8853137de2b99ef0f4c
SHA1

99387d92aee1ad50c8af0a5192f651ad8021d1d4
SHA256

76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882
SHA512

a43cc62e55da2d23f2f57bffc3e2f3e406e41b0e1ba24b38d274a12e25d87d005f89f03e98c4fbf91622b75a4009c38033ea9d74316696469d26f9ea3a3237fa
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx6:VIv/qiVNHNDEfJKHZ8mG9QeeO6

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

C2

bb.markerbio.com:13307

bb.myserv012.com:13307

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 1 IoCs

Processes:

resource	yara_rule
/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767	family_xorddos

Deletes itself 45 IoCs

Processes:

pid
1485
1488
1494
1498
1501
1719
1722
1725
1728
1731
1963
2055
2354
2357
2360
2363
2366
2384
2399
2402
2405
2408
2411
2414
2429
2432
2435
2438
2441
2444
2447
2450
2453
2456
2459
2462
2465
2468
2471
2474
2535
2538
2541
2544
2547

Executes dropped EXE 40 IoCs

Processes:

mzjbubxmlglvimfvvoxhceyqcltgpmexcsrsvjghiuonrjdqfuqvavivbhhxjzoduadcjnxcoifealbtibqyrrhyoszvuhayqpvpslzqusmszkcykhnnjkkcxtreoyleeuncljwzbjiajtjishuxhnvwajxbfnsfahwmroxdiuexqowmaqxobgmdoyqgfsofhrcmazzuelqrksbdsdchitjmfmvxlfdgzsatznlshkiafnemyxemeqjbdojpferafelznmxlrnqlocpchflklarwyalbhrohfxtlkrbpertttbgpmggkaglnueyblxwqiijlzetjzxkgmyoujdwdmqikutxihlzglrvnjaqxxhqfhsnfnyvgdpkaxtnybyxnbxgyqfinocawp

ioc	pid	process
/usr/bin/mzjbubxml	1484	mzjbubxml
/usr/bin/glvimf	1487	glvimf
/usr/bin/vvoxhceyq	1493	vvoxhceyq
/usr/bin/cltgpmexcsrsvj	1497	cltgpmexcsrsvj
/usr/bin/ghiuonrjdq	1500	ghiuonrjdq
/usr/bin/fuqvavivb	1718	fuqvavivb
/usr/bin/hhxjzoduadcjn	1721	hhxjzoduadcjn
/usr/bin/xcoifealbtibq	1724	xcoifealbtibq
/usr/bin/yrrhyosz	1727	yrrhyosz
/usr/bin/vuhayqpvpslz	1730	vuhayqpvpslz
/usr/bin/qusmszk	2353	qusmszk
/usr/bin/cykhnnjkkcxtr	2356	cykhnnjkkcxtr
/usr/bin/eoyleeuncljwzb	2359	eoyleeuncljwzb
/usr/bin/jiajtj	2362	jiajtj
/usr/bin/ishuxhn	2365	ishuxhn
/usr/bin/vwajxbf	2398	vwajxbf
/usr/bin/nsfahwmroxdiue	2401	nsfahwmroxdiue
/usr/bin/xqowmaq	2404	xqowmaq
/usr/bin/xobgmdoyqgfso	2407	xobgmdoyqgfso
/usr/bin/fhrcmaz	2410	fhrcmaz
/usr/bin/zuelqr	2428	zuelqr
/usr/bin/ksbdsdchitj	2431	ksbdsdchitj
/usr/bin/mfmvxlfdg	2434	mfmvxlfdg
/usr/bin/zsatznlsh	2437	zsatznlsh
/usr/bin/kiafnem	2440	kiafnem
/usr/bin/yxemeqjbdo	2443	yxemeqjbdo
/usr/bin/jpferafelzn	2446	jpferafelzn
/usr/bin/mxlrnq	2449	mxlrnq
/usr/bin/locpchflklarw	2452	locpchflklarw
/usr/bin/yalbhrohfxt	2455	yalbhrohfxt
/usr/bin/lkrbperttt	2458	lkrbperttt
/usr/bin/bgpmggkagln	2461	bgpmggkagln
/usr/bin/ueyblxwqiijlz	2464	ueyblxwqiijlz
/usr/bin/etjzxkgmyouj	2467	etjzxkgmyouj
/usr/bin/dwdmqikut	2470	dwdmqikut
/usr/bin/xihlzglrvnjaqx	2534	xihlzglrvnjaqx
/usr/bin/xhqfhsnfny	2537	xhqfhsnfny
/usr/bin/vgdpkaxtnyby	2540	vgdpkaxtnyby
/usr/bin/xnbxgyqf	2543	xnbxgyqf
/usr/bin/inocawp	2546	inocawp

Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

description ioc

File opened for modification /etc/cron.hourly/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

File opened for reading /proc/net/tcp
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

description	ioc
File opened for modification	/etc/cron.hourly/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh

description	ioc
File opened for reading	/proc/net/tcp

description	ioc
File opened for modification	/etc/init.d/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

Write file to user bin folder 1 TTPs 40 IoCs

Hijack Execution Flow

T1574

Processes:

description	ioc
File opened for modification	/usr/bin/nsfahwmroxdiue
File opened for modification	/usr/bin/zsatznlsh
File opened for modification	/usr/bin/bgpmggkagln
File opened for modification	/usr/bin/dwdmqikut
File opened for modification	/usr/bin/hhxjzoduadcjn
File opened for modification	/usr/bin/cykhnnjkkcxtr
File opened for modification	/usr/bin/jpferafelzn
File opened for modification	/usr/bin/xihlzglrvnjaqx
File opened for modification	/usr/bin/mzjbubxml
File opened for modification	/usr/bin/yxemeqjbdo
File opened for modification	/usr/bin/fhrcmaz
File opened for modification	/usr/bin/ksbdsdchitj
File opened for modification	/usr/bin/inocawp
File opened for modification	/usr/bin/vvoxhceyq
File opened for modification	/usr/bin/xobgmdoyqgfso
File opened for modification	/usr/bin/eoyleeuncljwzb
File opened for modification	/usr/bin/kiafnem
File opened for modification	/usr/bin/lkrbperttt
File opened for modification	/usr/bin/yrrhyosz
File opened for modification	/usr/bin/qusmszk
File opened for modification	/usr/bin/jiajtj
File opened for modification	/usr/bin/vwajxbf
File opened for modification	/usr/bin/locpchflklarw
File opened for modification	/usr/bin/yalbhrohfxt
File opened for modification	/usr/bin/ueyblxwqiijlz
File opened for modification	/usr/bin/ghiuonrjdq
File opened for modification	/usr/bin/vuhayqpvpslz
File opened for modification	/usr/bin/xhqfhsnfny
File opened for modification	/usr/bin/mfmvxlfdg
File opened for modification	/usr/bin/etjzxkgmyouj
File opened for modification	/usr/bin/ishuxhn
File opened for modification	/usr/bin/xqowmaq
File opened for modification	/usr/bin/zuelqr
File opened for modification	/usr/bin/mxlrnq
File opened for modification	/usr/bin/vgdpkaxtnyby
File opened for modification	/usr/bin/xnbxgyqf
File opened for modification	/usr/bin/cltgpmexcsrsvj
File opened for modification	/usr/bin/xcoifealbtibq
File opened for modification	/usr/bin/glvimf
File opened for modification	/usr/bin/fuqvavivb

Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/tcp

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/492/fd
File opened for reading	/proc/1065/fd
File opened for reading	/proc/1290/fd
File opened for reading	/proc/971/fd
File opened for reading	/proc/638/fd
File opened for reading	/proc/392/fd
File opened for reading	/proc/1219/fd
File opened for reading	/proc/1535/fd
File opened for reading	/proc/1040/fd
File opened for reading	/proc/1105/fd
File opened for reading	/proc/856/fd
File opened for reading	/proc/2226/fd
File opened for reading	/proc/2577/fd
File opened for reading	/proc/1972/fd
File opened for reading	/proc/1949/fd
File opened for reading	/proc/761/fd
File opened for reading	/proc/2091/fd
File opened for reading	/proc/2224/fd
File opened for reading	/proc/2574/fd
File opened for reading	/proc/487/fd
File opened for reading	/proc/1963/fd
File opened for reading	/proc/582/fd
File opened for reading	/proc/800/fd
File opened for reading	/proc/958/fd
File opened for reading	/proc/1053/fd
File opened for reading	/proc/1044/fd
File opened for reading	/proc/1104/fd
File opened for reading	/proc/1127/fd
File opened for reading	/proc/2483/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/452/fd
File opened for reading	/proc/1138/fd
File opened for reading	/proc/808/fd
File opened for reading	/proc/864/fd
File opened for reading	/proc/445/fd
File opened for reading	/proc/1027/fd
File opened for reading	/proc/532/fd
File opened for reading	/proc/1130/fd
File opened for reading	/proc/1396/fd
File opened for reading	/proc/2223/fd
File opened for reading	/proc/579/fd
File opened for reading	/proc/536/fd
File opened for reading	/proc/1932/fd
File opened for reading	/proc/2486/fd
File opened for reading	/proc/2571/fd
File opened for reading	/proc/437/fd
File opened for reading	/proc/783/fd
File opened for reading	/proc/1078/fd
File opened for reading	/proc/671/fd
File opened for reading	/proc/499/fd
File opened for reading	/proc/1975/fd
File opened for reading	/proc/562/fd
File opened for reading	/proc/440/fd
File opened for reading	/proc/1111/fd
File opened for reading	/proc/1465/fd
File opened for reading	/proc/1549/fd
File opened for reading	/proc/997/fd
File opened for reading	/proc/438/fd
File opened for reading	/proc/567/fd
File opened for reading	/proc/637/fd
File opened for reading	/proc/1000/fd
File opened for reading	/proc/2097/fd
File opened for reading	/proc/269/fd
File opened for reading	/proc/1079/fd

Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes:

description ioc

File opened for modification /dev/shm/sem.cmsgpg
File opened for modification /dev/shm/sem.hS1Yix

description	ioc
File opened for modification	/dev/shm/sem.cmsgpg
File opened for modification	/dev/shm/sem.hS1Yix

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767
File opened for modification	/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh

/tmp/76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882.elf
/tmp/76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882.elf
1⤵
PID:1479

/usr/bin/mzjbubxml
/usr/bin/mzjbubxml -d 1480
1⤵
- Executes dropped EXE
PID:1484

/usr/bin/glvimf
/usr/bin/glvimf -d 1480
1⤵
- Executes dropped EXE
PID:1487

/usr/bin/vvoxhceyq
/usr/bin/vvoxhceyq -d 1480
1⤵
- Executes dropped EXE
PID:1493

/usr/bin/cltgpmexcsrsvj
/usr/bin/cltgpmexcsrsvj -d 1480
1⤵
- Executes dropped EXE
PID:1497

/usr/bin/ghiuonrjdq
/usr/bin/ghiuonrjdq -d 1480
1⤵
- Executes dropped EXE
PID:1500

/usr/bin/fuqvavivb
/usr/bin/fuqvavivb -d 1480
1⤵
- Executes dropped EXE
PID:1718

/usr/bin/hhxjzoduadcjn
/usr/bin/hhxjzoduadcjn -d 1480
1⤵
- Executes dropped EXE
PID:1721

/usr/bin/xcoifealbtibq
/usr/bin/xcoifealbtibq -d 1480
1⤵
- Executes dropped EXE
PID:1724

/usr/bin/yrrhyosz
/usr/bin/yrrhyosz -d 1480
1⤵
- Executes dropped EXE
PID:1727

/usr/bin/vuhayqpvpslz
/usr/bin/vuhayqpvpslz -d 1480
1⤵
- Executes dropped EXE
PID:1730

/usr/bin/qusmszk
/usr/bin/qusmszk -d 1480
1⤵
- Executes dropped EXE
PID:2353

/usr/bin/cykhnnjkkcxtr
/usr/bin/cykhnnjkkcxtr -d 1480
1⤵
- Executes dropped EXE
PID:2356

/usr/bin/eoyleeuncljwzb
/usr/bin/eoyleeuncljwzb -d 1480
1⤵
- Executes dropped EXE
PID:2359

/usr/bin/jiajtj
/usr/bin/jiajtj -d 1480
1⤵
- Executes dropped EXE
PID:2362

/usr/bin/ishuxhn
/usr/bin/ishuxhn -d 1480
1⤵
- Executes dropped EXE
PID:2365

/usr/bin/vwajxbf
/usr/bin/vwajxbf -d 1480
1⤵
- Executes dropped EXE
PID:2398

/usr/bin/nsfahwmroxdiue
/usr/bin/nsfahwmroxdiue -d 1480
1⤵
- Executes dropped EXE
PID:2401

/usr/bin/xqowmaq
/usr/bin/xqowmaq -d 1480
1⤵
- Executes dropped EXE
PID:2404

/usr/bin/xobgmdoyqgfso
/usr/bin/xobgmdoyqgfso -d 1480
1⤵
- Executes dropped EXE
PID:2407

/usr/bin/fhrcmaz
/usr/bin/fhrcmaz -d 1480
1⤵
- Executes dropped EXE
PID:2410

/usr/bin/zuelqr
/usr/bin/zuelqr -d 1480
1⤵
- Executes dropped EXE
PID:2428

/usr/bin/ksbdsdchitj
/usr/bin/ksbdsdchitj -d 1480
1⤵
- Executes dropped EXE
PID:2431

/usr/bin/mfmvxlfdg
/usr/bin/mfmvxlfdg -d 1480
1⤵
- Executes dropped EXE
PID:2434

/usr/bin/zsatznlsh
/usr/bin/zsatznlsh -d 1480
1⤵
- Executes dropped EXE
PID:2437

/usr/bin/kiafnem
/usr/bin/kiafnem -d 1480
1⤵
- Executes dropped EXE
PID:2440

/usr/bin/yxemeqjbdo
/usr/bin/yxemeqjbdo -d 1480
1⤵
- Executes dropped EXE
PID:2443

/usr/bin/jpferafelzn
/usr/bin/jpferafelzn -d 1480
1⤵
- Executes dropped EXE
PID:2446

/usr/bin/mxlrnq
/usr/bin/mxlrnq -d 1480
1⤵
- Executes dropped EXE
PID:2449

/usr/bin/locpchflklarw
/usr/bin/locpchflklarw -d 1480
1⤵
- Executes dropped EXE
PID:2452

/usr/bin/yalbhrohfxt
/usr/bin/yalbhrohfxt -d 1480
1⤵
- Executes dropped EXE
PID:2455

/usr/bin/lkrbperttt
/usr/bin/lkrbperttt -d 1480
1⤵
- Executes dropped EXE
PID:2458

/usr/bin/bgpmggkagln
/usr/bin/bgpmggkagln -d 1480
1⤵
- Executes dropped EXE
PID:2461

/usr/bin/ueyblxwqiijlz
/usr/bin/ueyblxwqiijlz -d 1480
1⤵
- Executes dropped EXE
PID:2464

/usr/bin/etjzxkgmyouj
/usr/bin/etjzxkgmyouj -d 1480
1⤵
- Executes dropped EXE
PID:2467

/usr/bin/dwdmqikut
/usr/bin/dwdmqikut -d 1480
1⤵
- Executes dropped EXE
PID:2470

/usr/bin/xihlzglrvnjaqx
/usr/bin/xihlzglrvnjaqx -d 1480
1⤵
- Executes dropped EXE
PID:2534

/usr/bin/xhqfhsnfny
/usr/bin/xhqfhsnfny -d 1480
1⤵
- Executes dropped EXE
PID:2537

/usr/bin/vgdpkaxtnyby
/usr/bin/vgdpkaxtnyby -d 1480
1⤵
- Executes dropped EXE
PID:2540

/usr/bin/xnbxgyqf
/usr/bin/xnbxgyqf -d 1480
1⤵
- Executes dropped EXE
PID:2543

/usr/bin/inocawp
/usr/bin/inocawp -d 1480
1⤵
- Executes dropped EXE
PID:2546

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

1

T1574

Privilege Escalation

Scheduled Task/Job

1

T1053

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

1

T1574

Defense Evasion

Hijack Execution Flow

1

T1574

Credential Access

Discovery

System Network Connections Discovery

1

T1049

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh
Filesize
205B

MD5
88df968a086fa23d75ab76030e9cb303

SHA1
50331a4e1cf17a0fb908816f4f97fab6d7f940ee

SHA256
4edf60882f160abdc96533c2b4e14dc29bf1413371394dd8f903e0305afa95f0

SHA512
461598ec9999711bcafe35a8c635dd619c02931dac6e918277393d3eac414032827cbeda424933f657af32ebb4c86a2aec5fa61dacfce3ee490babb01cd99f11

Download Submit
/etc/daemon.cfg
Filesize
32B

MD5
b24214956234daf0359941b6f4325e8c

SHA1
da01db26b1b98b1d99a60b77d40f7df8a5d7a5b1

SHA256
71ee4002076f6dfeb57d40c501543517ee79409615f00978c5bced1519f327a1

SHA512
64f5e3035f7616bc84a713e79758ce98ace7b196abb944bee970dad15d2f4feecedc26d6a32d791683124e05d282516573c5a693c12eeecfa4c7b6e6034df087

Download Submit
/etc/init.d/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767
Filesize
628B

MD5
f5b2ac46bc80c9ee024db2272cd03764

SHA1
44c3f3211ee101ef217cd9d6160b640cd968c538

SHA256
d9d0c16a7151fc21c2ab1cfe7438032c61161956601980dc15a42a85aacd431e

SHA512
95df75972e8904826c51b7da80abdb7f91da9fc24b8558da4f7e300c0e3e62854696a318cef8b25ed97362186f929c49e9b32647c77a418b68bf2552e566c631

Download Submit
/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767
Filesize
549KB

MD5
455b46bf3f93b8853137de2b99ef0f4c

SHA1
99387d92aee1ad50c8af0a5192f651ad8021d1d4

SHA256
76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882

SHA512
a43cc62e55da2d23f2f57bffc3e2f3e406e41b0e1ba24b38d274a12e25d87d005f89f03e98c4fbf91622b75a4009c38033ea9d74316696469d26f9ea3a3237fa

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads