Overview

overview

10

Static

static

10

75bfd448e4...19.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75bfd448e4274cc4e5804c43768f62a36ccb3fc3b1df06e14d9c892daa2cde19.elf

  • Size

    535KB

  • Sample

    240410-cs32esbh73

  • MD5

    694a672878a1f7945c020a0a3ca74367

  • SHA1

    148caeaa8ac7fdf46d48fc2d1d0020d1bf41d442

  • SHA256

    75bfd448e4274cc4e5804c43768f62a36ccb3fc3b1df06e14d9c892daa2cde19

  • SHA512

    a239845b91d64b8559192e4683e2faa16ad0c8987bfc142cf692f620bd5fefa0d8d0bbe2e7f5f59651435eec4350e3574171d33e7cd4656136b539bccd00fb60

  • SSDEEP

    12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzP66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5PfjQn36Eu

Score
10/10
xorddosantivmbotnetdownloaderlinuxpersistence

Malware Config

Extracted

Family

xorddos

C2

https://ww.aass654.com/config.rar

ee.aass654.com:1520

ee.xxcc789.com:1520

ee.vvbb321.com:1520

ee.jjkk567.com:1520

ee.nnmm234.com:1520
Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target

      75bfd448e4274cc4e5804c43768f62a36ccb3fc3b1df06e14d9c892daa2cde19.elf

    • Size

      535KB

    • MD5

      694a672878a1f7945c020a0a3ca74367

    • SHA1

      148caeaa8ac7fdf46d48fc2d1d0020d1bf41d442

    • SHA256

      75bfd448e4274cc4e5804c43768f62a36ccb3fc3b1df06e14d9c892daa2cde19

    • SHA512

      a239845b91d64b8559192e4683e2faa16ad0c8987bfc142cf692f620bd5fefa0d8d0bbe2e7f5f59651435eec4350e3574171d33e7cd4656136b539bccd00fb60

    • SSDEEP

      12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzP66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5PfjQn36Eu

    Score
    10/10
    xorddosantivmbotnetdownloaderpersistence

    • XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Executes dropped EXE

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Boot or Logon Autostart Execution

1
T1547

Hijack Execution Flow

1
T1574

Privilege Escalation

Scheduled Task/Job

1
T1053

Boot or Logon Autostart Execution

1
T1547

Hijack Execution Flow

1
T1574

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Hijack Execution Flow

1
T1574

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks