xorddos | ae38c170144317b0f8e3e0a761085431e18d2eac562622880a6d8e83fd4dee88

General

Target

76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882.elf
Size

549KB
MD5

455b46bf3f93b8853137de2b99ef0f4c
SHA1

99387d92aee1ad50c8af0a5192f651ad8021d1d4
SHA256

76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882
SHA512

a43cc62e55da2d23f2f57bffc3e2f3e406e41b0e1ba24b38d274a12e25d87d005f89f03e98c4fbf91622b75a4009c38033ea9d74316696469d26f9ea3a3237fa
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx6:VIv/qiVNHNDEfJKHZ8mG9QeeO6

Score

10^/10

xorddos botnet downloader persistence

Malware Config

Extracted

Family

xorddos

C2

bb.markerbio.com:13307

bb.myserv012.com:13307

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 2 IoCs

Processes:

resource	yara_rule
/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767	family_xorddos
/usr/bin/ofdwrlnduve	family_xorddos

Deletes itself 40 IoCs

Processes:

pid
1487
1491
1494
1497
1500
1715
1718
1721
1724
1727
2151
2154
2157
2160
2163
2278
2308
2311
2314
2317
2320
2383
2392
2395
2398
2413
2473
2476
2479
2482
2549
2552
2555
2558
2561
2564
2567
2570
2573
2576

Executes dropped EXE 36 IoCs

Processes:

ofdwrlnduvemxlgfmpuupmqudrrivlxqnzqmxwaggxroedfyzxrrqkkjufuxkrpyqorquzpnuqvurshilztwlffdpwupmihfcupwqhtnyluywauhnaoufgqzvbmpdpjasnydncmsstanhmrvgvyxrtbfevsgphxonszelsgybtmtisahzfqtftxqxnfjxdkarshmmocykrltsrkbpwifuxrziqctqugfnyglvusokzinhfzjelnsvhcacwdnmukpygqzbyhhmvxreberubybdwertnzwvijdefholsmuyqarvbbrshifaxgxoizthfvqwhkwjdwayaeywyidzflyzbizqeylwwtjserfmrjdrhbakahxjyjivbotmksht

ioc	pid	process
/usr/bin/ofdwrlnduve	1486	ofdwrlnduve
/usr/bin/mxlgfmpuupmqud	1490	mxlgfmpuupmqud
/usr/bin/rrivlxqnzqmxw	1493	rrivlxqnzqmxw
/usr/bin/aggxroedfyzx	1496	aggxroedfyzx
/usr/bin/rrqkkjufu	1499	rrqkkjufu
/usr/bin/xkrpyqorquzp	1714	xkrpyqorquzp
/usr/bin/nuqvurshilztwl	1717	nuqvurshilztwl
/usr/bin/ffdpwupmihfc	1720	ffdpwupmihfc
/usr/bin/upwqhtnylu	1723	upwqhtnylu
/usr/bin/ywauhnaoufgqzv	1726	ywauhnaoufgqzv
/usr/bin/bmpdpjasn	2150	bmpdpjasn
/usr/bin/ydncmsstanhmrv	2153	ydncmsstanhmrv
/usr/bin/gvyxrtbf	2156	gvyxrtbf
/usr/bin/evsgphxon	2159	evsgphxon
/usr/bin/szelsgybt	2162	szelsgybt
/usr/bin/mtisahzfq	2307	mtisahzfq
/usr/bin/tftxqxn	2310	tftxqxn
/usr/bin/fjxdkarshmmocy	2313	fjxdkarshmmocy
/usr/bin/krltsrkb	2316	krltsrkb
/usr/bin/pwifuxrziqctq	2319	pwifuxrziqctq
/usr/bin/ugfnyglv	2391	ugfnyglv
/usr/bin/usokzinhf	2394	usokzinhf
/usr/bin/zjelnsvhcacwdn	2472	zjelnsvhcacwdn
/usr/bin/mukpygqzbyhhm	2475	mukpygqzbyhhm
/usr/bin/vxreberub	2478	vxreberub
/usr/bin/ybdwer	2481	ybdwer
/usr/bin/tnzwvijde	2548	tnzwvijde
/usr/bin/fholsmuy	2551	fholsmuy
/usr/bin/qarvbbr	2554	qarvbbr
/usr/bin/shifaxgx	2557	shifaxgx
/usr/bin/oizthf	2560	oizthf
/usr/bin/vqwhkwjdwayae	2563	vqwhkwjdwayae
/usr/bin/ywyidzflyzbiz	2566	ywyidzflyzbiz
/usr/bin/qeylwwtjse	2569	qeylwwtjse
/usr/bin/rfmrjdrhbakahx	2572	rfmrjdrhbakahx
/usr/bin/jyjivbotmksht	2575	jyjivbotmksht

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 114.114.114.114
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task/Job
T1053

Processes:

description ioc

File opened for modification /etc/cron.hourly/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery
T1049

Processes:

description ioc

File opened for reading /proc/net/tcp
Enumerates running processes
Discovers information about currently running processes on the system
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

description	ioc
Destination IP	114.114.114.114

description	ioc
File opened for modification	/etc/cron.hourly/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh

description	ioc
File opened for reading	/proc/net/tcp

description	ioc
File opened for modification	/etc/init.d/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

Write file to user bin folder 1 TTPs 37 IoCs

Hijack Execution Flow

T1574

Processes:

description	ioc
File opened for modification	/usr/bin/tftxqxn
File opened for modification	/usr/bin/wzkqzkia
File opened for modification	/usr/bin/pwifuxrziqctq
File opened for modification	/usr/bin/usokzinhf
File opened for modification	/usr/bin/zjelnsvhcacwdn
File opened for modification	/usr/bin/qarvbbr
File opened for modification	/usr/bin/oizthf
File opened for modification	/usr/bin/rfmrjdrhbakahx
File opened for modification	/usr/bin/fjxdkarshmmocy
File opened for modification	/usr/bin/mukpygqzbyhhm
File opened for modification	/usr/bin/tnzwvijde
File opened for modification	/usr/bin/vqwhkwjdwayae
File opened for modification	/usr/bin/qeylwwtjse
File opened for modification	/usr/bin/evsgphxon
File opened for modification	/usr/bin/xkrpyqorquzp
File opened for modification	/usr/bin/upwqhtnylu
File opened for modification	/usr/bin/ywauhnaoufgqzv
File opened for modification	/usr/bin/ybdwer
File opened for modification	/usr/bin/shifaxgx
File opened for modification	/usr/bin/rrivlxqnzqmxw
File opened for modification	/usr/bin/gvyxrtbf
File opened for modification	/usr/bin/vxreberub
File opened for modification	/usr/bin/tnjknramsyvzk
File opened for modification	/usr/bin/fholsmuy
File opened for modification	/usr/bin/ffdpwupmihfc
File opened for modification	/usr/bin/szelsgybt
File opened for modification	/usr/bin/mxlgfmpuupmqud
File opened for modification	/usr/bin/ydncmsstanhmrv
File opened for modification	/usr/bin/mtisahzfq
File opened for modification	/usr/bin/krltsrkb
File opened for modification	/usr/bin/ywyidzflyzbiz
File opened for modification	/usr/bin/ofdwrlnduve
File opened for modification	/usr/bin/rrqkkjufu
File opened for modification	/usr/bin/nuqvurshilztwl
File opened for modification	/usr/bin/bmpdpjasn
File opened for modification	/usr/bin/jyjivbotmksht
File opened for modification	/usr/bin/aggxroedfyzx

Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/tcp

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

description	ioc
File opened for reading	/proc/1724/fd
File opened for reading	/proc/646/fd
File opened for reading	/proc/516/fd
File opened for reading	/proc/1028/fd
File opened for reading	/proc/1240/fd
File opened for reading	/proc/1295/fd
File opened for reading	/proc/786/fd
File opened for reading	/proc/2189/fd
File opened for reading	/proc/2305/fd
File opened for reading	/proc/1082/fd
File opened for reading	/proc/1144/fd
File opened for reading	/proc/806/fd
File opened for reading	/proc/2452/fd
File opened for reading	/proc/1715/fd
File opened for reading	/proc/1099/fd
File opened for reading	/proc/1126/fd
File opened for reading	/proc/2455/fd
File opened for reading	/proc/558/fd
File opened for reading	/proc/2191/fd
File opened for reading	/proc/442/fd
File opened for reading	/proc/479/fd
File opened for reading	/proc/1180/fd
File opened for reading	/proc/1745/fd
File opened for reading	/proc/2056/fd
File opened for reading	/proc/2082/fd
File opened for reading	/proc/1102/fd
File opened for reading	/proc/2293/fd
File opened for reading	/proc/472/fd
File opened for reading	/proc/494/fd
File opened for reading	/proc/1544/fd
File opened for reading	/proc/901/fd
File opened for reading	/proc/1002/fd
File opened for reading	/proc/1098/fd
File opened for reading	/proc/919/fd
File opened for reading	/proc/681/fd
File opened for reading	/proc/798/fd
File opened for reading	/proc/2458/fd
File opened for reading	/proc/1614/fd
File opened for reading	/proc/835/fd
File opened for reading	/proc/978/fd
File opened for reading	/proc/1413/fd
File opened for reading	/proc/2062/fd
File opened for reading	/proc/2446/fd
File opened for reading	/proc/402/fd
File opened for reading	/proc/1109/fd
File opened for reading	/proc/764/fd
File opened for reading	/proc/2461/fd
File opened for reading	/proc/2470/fd
File opened for reading	/proc/1/fd
File opened for reading	/proc/1033/fd
File opened for reading	/proc/2076/fd
File opened for reading	/proc/563/fd
File opened for reading	/proc/453/fd
File opened for reading	/proc/1530/fd
File opened for reading	/proc/1073/fd
File opened for reading	/proc/1130/fd
File opened for reading	/proc/1138/fd
File opened for reading	/proc/615/fd
File opened for reading	/proc/2187/fd
File opened for reading	/proc/456/fd
File opened for reading	/proc/504/fd
File opened for reading	/proc/973/fd
File opened for reading	/proc/1038/fd
File opened for reading	/proc/622/fd

Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes:

description ioc

File opened for modification /dev/shm/sem.asukmz
File opened for modification /dev/shm/sem.5Vurdh

description	ioc
File opened for modification	/dev/shm/sem.asukmz
File opened for modification	/dev/shm/sem.5Vurdh

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh
File opened for modification	/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

/tmp/76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882.elf
/tmp/76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882.elf
1⤵
PID:1478

/usr/bin/ofdwrlnduve
/usr/bin/ofdwrlnduve -d 1479
1⤵
- Executes dropped EXE
PID:1486

/usr/bin/mxlgfmpuupmqud
/usr/bin/mxlgfmpuupmqud -d 1479
1⤵
- Executes dropped EXE
PID:1490

/usr/bin/rrivlxqnzqmxw
/usr/bin/rrivlxqnzqmxw -d 1479
1⤵
- Executes dropped EXE
PID:1493

/usr/bin/aggxroedfyzx
/usr/bin/aggxroedfyzx -d 1479
1⤵
- Executes dropped EXE
PID:1496

/usr/bin/rrqkkjufu
/usr/bin/rrqkkjufu -d 1479
1⤵
- Executes dropped EXE
PID:1499

/usr/bin/xkrpyqorquzp
/usr/bin/xkrpyqorquzp -d 1479
1⤵
- Executes dropped EXE
PID:1714

/usr/bin/nuqvurshilztwl
/usr/bin/nuqvurshilztwl -d 1479
1⤵
- Executes dropped EXE
PID:1717

/usr/bin/ffdpwupmihfc
/usr/bin/ffdpwupmihfc -d 1479
1⤵
- Executes dropped EXE
PID:1720

/usr/bin/upwqhtnylu
/usr/bin/upwqhtnylu -d 1479
1⤵
- Executes dropped EXE
PID:1723

/usr/bin/ywauhnaoufgqzv
/usr/bin/ywauhnaoufgqzv -d 1479
1⤵
- Executes dropped EXE
PID:1726

/usr/bin/bmpdpjasn
/usr/bin/bmpdpjasn -d 1479
1⤵
- Executes dropped EXE
PID:2150

/usr/bin/ydncmsstanhmrv
/usr/bin/ydncmsstanhmrv -d 1479
1⤵
- Executes dropped EXE
PID:2153

/usr/bin/gvyxrtbf
/usr/bin/gvyxrtbf -d 1479
1⤵
- Executes dropped EXE
PID:2156

/usr/bin/evsgphxon
/usr/bin/evsgphxon -d 1479
1⤵
- Executes dropped EXE
PID:2159

/usr/bin/szelsgybt
/usr/bin/szelsgybt -d 1479
1⤵
- Executes dropped EXE
PID:2162

/usr/bin/mtisahzfq
/usr/bin/mtisahzfq -d 1479
1⤵
- Executes dropped EXE
PID:2307

/usr/bin/tftxqxn
/usr/bin/tftxqxn -d 1479
1⤵
- Executes dropped EXE
PID:2310

/usr/bin/fjxdkarshmmocy
/usr/bin/fjxdkarshmmocy -d 1479
1⤵
- Executes dropped EXE
PID:2313

/usr/bin/krltsrkb
/usr/bin/krltsrkb -d 1479
1⤵
- Executes dropped EXE
PID:2316

/usr/bin/pwifuxrziqctq
/usr/bin/pwifuxrziqctq -d 1479
1⤵
- Executes dropped EXE
PID:2319

/usr/bin/ugfnyglv
/usr/bin/ugfnyglv -d 1479
1⤵
- Executes dropped EXE
PID:2391

/usr/bin/usokzinhf
/usr/bin/usokzinhf -d 1479
1⤵
- Executes dropped EXE
PID:2394

/usr/bin/zjelnsvhcacwdn
/usr/bin/zjelnsvhcacwdn -d 1479
1⤵
- Executes dropped EXE
PID:2472

/usr/bin/mukpygqzbyhhm
/usr/bin/mukpygqzbyhhm -d 1479
1⤵
- Executes dropped EXE
PID:2475

/usr/bin/vxreberub
/usr/bin/vxreberub -d 1479
1⤵
- Executes dropped EXE
PID:2478

/usr/bin/ybdwer
/usr/bin/ybdwer -d 1479
1⤵
- Executes dropped EXE
PID:2481

/usr/bin/tnzwvijde
/usr/bin/tnzwvijde -d 1479
1⤵
- Executes dropped EXE
PID:2548

/usr/bin/fholsmuy
/usr/bin/fholsmuy -d 1479
1⤵
- Executes dropped EXE
PID:2551

/usr/bin/qarvbbr
/usr/bin/qarvbbr -d 1479
1⤵
- Executes dropped EXE
PID:2554

/usr/bin/shifaxgx
/usr/bin/shifaxgx -d 1479
1⤵
- Executes dropped EXE
PID:2557

/usr/bin/oizthf
/usr/bin/oizthf -d 1479
1⤵
- Executes dropped EXE
PID:2560

/usr/bin/vqwhkwjdwayae
/usr/bin/vqwhkwjdwayae -d 1479
1⤵
- Executes dropped EXE
PID:2563

/usr/bin/ywyidzflyzbiz
/usr/bin/ywyidzflyzbiz -d 1479
1⤵
- Executes dropped EXE
PID:2566

/usr/bin/qeylwwtjse
/usr/bin/qeylwwtjse -d 1479
1⤵
- Executes dropped EXE
PID:2569

/usr/bin/rfmrjdrhbakahx
/usr/bin/rfmrjdrhbakahx -d 1479
1⤵
- Executes dropped EXE
PID:2572

/usr/bin/jyjivbotmksht
/usr/bin/jyjivbotmksht -d 1479
1⤵
- Executes dropped EXE
PID:2575

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

Scheduled Task/Job

Defense Evasion

Hijack Execution Flow

1

T1574

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

System Network Connections Discovery

1

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767.sh

Filesize
205B

MD5
5013939dd6eedc9cd8f76575349143de

SHA1
8acfe8c131707e6214b6a9b533094dea2131bec1

SHA256
a7f6416884fcc18e9886cc368c9ef3f337b455f9357cb46a7c1a2d591d1afb20

SHA512
7df566f6564ec33441d361495c1fd686d1dfdad9ebc10f419fa9464ba7f94442449fdd2aa5e4d52debb232b5ed646e481e99436dc96d9da240b1e68da1cb2476

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
f56e0d51d4b8c98ee1b195a0130465a0

SHA1
77a93d7d33c7bfa9d2be0f96d6723b686004e4ca

SHA256
5f21b70006387085933cd6b98e139cdd9aebd1b66c39bd698ea296b98212f1f8

SHA512
7529a74a6c2eebbfd2ad66d3f08d3af7b6dae613213f09292e86be8d88e78657b75fc1cfa76e849ebdbc3b732f880d3d6e15d65dd4a4c0c41907df6d8cda3426

Download Submit
/etc/init.d/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

Filesize
628B

MD5
f5b2ac46bc80c9ee024db2272cd03764

SHA1
44c3f3211ee101ef217cd9d6160b640cd968c538

SHA256
d9d0c16a7151fc21c2ab1cfe7438032c61161956601980dc15a42a85aacd431e

SHA512
95df75972e8904826c51b7da80abdb7f91da9fc24b8558da4f7e300c0e3e62854696a318cef8b25ed97362186f929c49e9b32647c77a418b68bf2552e566c631

Download Submit
/tmp/fle.2889f726aa72b00c75477abe399a814f7cc943dd5ad87a9d5e68edea12714767

Filesize
549KB

MD5
455b46bf3f93b8853137de2b99ef0f4c

SHA1
99387d92aee1ad50c8af0a5192f651ad8021d1d4

SHA256
76741721aede86e5d9a78da5dd349cc7f418a993eba77457c00b27aa627f9882

SHA512
a43cc62e55da2d23f2f57bffc3e2f3e406e41b0e1ba24b38d274a12e25d87d005f89f03e98c4fbf91622b75a4009c38033ea9d74316696469d26f9ea3a3237fa

Download Submit
/usr/bin/ofdwrlnduve

Filesize
104KB

MD5
0142614308b9bf4d759663d8032f9463

SHA1
5ff9ce302aa7a7eadf0cd7af3fa2ce83f77c5cf7

SHA256
4b60b30d5fef9c694b9b4ca3d4acd1eb396100146f80c0a5bddbd1fad779c7a1

SHA512
4388d9ffd9e3e4137d1f7be319707ae7dd809ca83e26acadafb55d3fb67353e400fdc6cfcab76c98fe0b03e42871f3f288d6b32020dd37c61862d3bfed3b7217

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads