Analysis
-
max time kernel
29s -
max time network
32s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240418-en -
resource tags
-
submitted
27-04-2024 19:52
General
-
Target
fb18a78ab398c101ec335992020bdbf6ca35db5d74b6c708d126cf4d4ebf289d.elf
-
Size
549KB
-
MD5
450cea21132fad13be77c7030d2a9e9d
-
SHA1
e0fdfb05fb79f5ba1cafc69b78a50a0eed6eeedb
-
SHA256
fb18a78ab398c101ec335992020bdbf6ca35db5d74b6c708d126cf4d4ebf289d
-
SHA512
6d282ecf3df15592a2e000906e5aca9665421309a35b31d7aed3cedcc0f46b2f7b6db2426afa7a02f49173b59b9be5c6089dbd0f8a4da8e962ca254e00854f49
-
SSDEEP
12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO
Malware Config
Extracted
xorddos
user.myserv012.com:123
user.search2c.com:123
http://qq.com/lib.asp
-
crc_polynomial
CDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 36 IoCs
-
Executes dropped EXE 36 IoCs
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Modifies init.d 1 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 38 IoCs
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to shm directory 2 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
Processes
-
/tmp/fb18a78ab398c101ec335992020bdbf6ca35db5d74b6c708d126cf4d4ebf289d.elf/tmp/fb18a78ab398c101ec335992020bdbf6ca35db5d74b6c708d126cf4d4ebf289d.elf1⤵
- Write file to user bin folder
- Reads runtime system information
-
/usr/bin/uqgzbyvriie/usr/bin/uqgzbyvriie1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Modifies init.d
- Write file to user bin folder
- Reads runtime system information
- Writes file to shm directory
-
/usr/bin/khkzindyujf/usr/bin/khkzindyujf -d 15081⤵
- Executes dropped EXE
-
/usr/bin/vhstgurm/usr/bin/vhstgurm -d 15081⤵
- Executes dropped EXE
-
/usr/bin/qazcwzgjjh/usr/bin/qazcwzgjjh -d 15081⤵
- Executes dropped EXE
-
/usr/bin/iggpsdphbrs/usr/bin/iggpsdphbrs -d 15081⤵
- Executes dropped EXE
-
/usr/bin/knsiwfrmkt/usr/bin/knsiwfrmkt -d 15081⤵
- Executes dropped EXE
-
/usr/bin/fjsecbx/usr/bin/fjsecbx -d 15081⤵
- Executes dropped EXE
-
/usr/bin/vrgtfs/usr/bin/vrgtfs -d 15081⤵
- Executes dropped EXE
-
/usr/bin/rfnirbwliwj/usr/bin/rfnirbwliwj -d 15081⤵
- Executes dropped EXE
-
/usr/bin/mvqksa/usr/bin/mvqksa -d 15081⤵
- Executes dropped EXE
-
/usr/bin/uhffcqrwaagi/usr/bin/uhffcqrwaagi -d 15081⤵
- Executes dropped EXE
-
/usr/bin/mgoighfwv/usr/bin/mgoighfwv -d 15081⤵
- Executes dropped EXE
-
/usr/bin/yvojxtec/usr/bin/yvojxtec -d 15081⤵
- Executes dropped EXE
-
/usr/bin/vjjizytnmb/usr/bin/vjjizytnmb -d 15081⤵
- Executes dropped EXE
-
/usr/bin/jfvgeonk/usr/bin/jfvgeonk -d 15081⤵
- Executes dropped EXE
-
/usr/bin/wihcrprtipd/usr/bin/wihcrprtipd -d 15081⤵
- Executes dropped EXE
-
/usr/bin/okldpqxovx/usr/bin/okldpqxovx -d 15081⤵
- Executes dropped EXE
-
/usr/bin/xsnnkoxnvglhh/usr/bin/xsnnkoxnvglhh -d 15081⤵
- Executes dropped EXE
-
/usr/bin/xonesysf/usr/bin/xonesysf -d 15081⤵
- Executes dropped EXE
-
/usr/bin/ywevkzuhxnwm/usr/bin/ywevkzuhxnwm -d 15081⤵
- Executes dropped EXE
-
/usr/bin/klmfrxo/usr/bin/klmfrxo -d 15081⤵
- Executes dropped EXE
-
/usr/bin/soqnwi/usr/bin/soqnwi -d 15081⤵
- Executes dropped EXE
-
/usr/bin/ydgwdrp/usr/bin/ydgwdrp -d 15081⤵
- Executes dropped EXE
-
/usr/bin/zxctjevooj/usr/bin/zxctjevooj -d 15081⤵
- Executes dropped EXE
-
/usr/bin/axvkspak/usr/bin/axvkspak -d 15081⤵
- Executes dropped EXE
-
/usr/bin/wuiwzoucgkhfj/usr/bin/wuiwzoucgkhfj -d 15081⤵
- Executes dropped EXE
-
/usr/bin/luucmks/usr/bin/luucmks -d 15081⤵
- Executes dropped EXE
-
/usr/bin/pjsviolnwfeeo/usr/bin/pjsviolnwfeeo -d 15081⤵
- Executes dropped EXE
-
/usr/bin/dztgssvpegja/usr/bin/dztgssvpegja -d 15081⤵
- Executes dropped EXE
-
/usr/bin/vkcebn/usr/bin/vkcebn -d 15081⤵
- Executes dropped EXE
-
/usr/bin/zymkljrsnhp/usr/bin/zymkljrsnhp -d 15081⤵
- Executes dropped EXE
-
/usr/bin/flmbkvece/usr/bin/flmbkvece -d 15081⤵
- Executes dropped EXE
-
/usr/bin/oxahcrk/usr/bin/oxahcrk -d 15081⤵
- Executes dropped EXE
-
/usr/bin/hoggtsmyp/usr/bin/hoggtsmyp -d 15081⤵
- Executes dropped EXE
-
/usr/bin/ngvdodwhsuwgi/usr/bin/ngvdodwhsuwgi -d 15081⤵
- Executes dropped EXE
-
/usr/bin/aoxhalimgo/usr/bin/aoxhalimgo -d 15081⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5076933ff9904d1110d896e2c525e39e5
SHA14188442577fa77f25820d9b2d01cc446e30684ac
SHA2564cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0
SHA5126fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34
-
Filesize
160B
MD5b4fa77a8b1af281a2b7ca703b9cdeba2
SHA11edbdc4bb48dbd07b1b55b4f47b466278fbd5320
SHA256bb0f3e9386eb009a2d7ce8f40c12ae1c4ca69425f57f1d65603ad33e01d20015
SHA5120ab0350b82a88dad9f05d6ac9ff15a7937b34e5c76e0d661bb61a5a794a696666c47d19221c13788027a7455f197acec89ea5550b619d3ab455d62a1b0d6ceb9
-
Filesize
32B
MD5dd3a9d8e3dd2fc1de1a41467af0da1d8
SHA10de8c8510ea7251b3afced94d8636ee01f8247be
SHA2565e46f097dfce3cf2d5f1bf573f1c85f9671cca43bd65495cc8dca7dae685c09e
SHA5127aabaa6dcd0dc2f754e586d95b346461e14a5afc04c280f239e7e4ccbedf85af5c61b02a1e336250c121f71c953ff57c67eac8eb75bd019d17f0cd9e270dfd40
-
Filesize
351B
MD5d4b124ec20e2206aa7b27a642a5cb181
SHA136eead902c57eb8c1efca7532aa3becf1539eb94
SHA2562c072e3644f2857df3414a4f953dbc48675cb31471ef266137ac2c7fa654d610
SHA512d32c74dffed0f968739d1650b598e9db07c05c886820532e4a2a54a185f403641b3792f2ac494ce3e93064c457c4565949ba576c89d24f304efcf02720a794a7
-
Filesize
549KB
MD50fb6d6fffc40d9fe2cca8af68aa25952
SHA108a6569ef372c3057df1fd401d5a5c9f14168885
SHA256213102a3010629b242d6feaca1636d58cee2e595e98f5d4d829888f84ab01d09
SHA512267bd90c320da9ef3228dd51822ecc9e5c3a5c367c12d657c40523aa0804a4acc18081531a3bcc04b80aa6a4e037fe4b8a6c59b2bb72679a83906241f7b012af