Extracted

• • Target

    c6cab8b20d43e2110018b9422170b29a

  • Size

    536KB

  • MD5

    c6cab8b20d43e2110018b9422170b29a

  • SHA1

    94a9dbcfd1a86df92a327a8deab0b6ad01a40fda

  • SHA256

    f4c3c89d105115f16c668e62809b61518511b025e12e8e0c3a962a96318385a0

  • SHA512

    39cd46bb9d3157df70e0d57305e055540d172b48d36512e7117b3883dd045c959e8934b99097f5d70c5711c7c319563fc20fa0210f3a94b7a1046ddf999f1809

  • SSDEEP

    12288:vPTJS+naeW9kclFEcMWbHdxZ7GkR2fh/6y9P/Yz:nTJfrW99q4bHdxZ7G1fhFW

  Score

  10^/10

  xorddosantivmbotnetdownloaderpersistence

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  behavioral1