Extracted

• • Target

    1.txt

  • Size

    535KB

  • MD5

    f075a45d0f9159aca526e13870de7b28

  • SHA1

    1f74f062b39def7ba488b1e5dfcd56fcb87c5768

  • SHA256

    a544fa8b34122876e3e0140c480c967aad0b26d84823ae6fdd1bc961e47d8b15

  • SHA512

    a8f3035f3b88f3c4250fc869b4890b4a5d3bcf1333c2a13a43c8f2a1775b828173787fc65ff04e48b9984e10f601a30c25a6c32a7114166e0b91ba14f3be3f50

  • SSDEEP

    12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzD66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5DfjQn36Eu

  Score

  10^/10

  xorddosantivmbotnetdownloaderinfostealerpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Deletes itself

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    infostealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  • Writes file to system bin folder

  behavioral1