Extracted

• • Target

    00e7122e581622802dab4d3e4ac463b8

  • Size

    596KB

  • MD5

    00e7122e581622802dab4d3e4ac463b8

  • SHA1

    430442cc603d4a6fb331bf165c2e507aef2bb03e

  • SHA256

    1dc964938e1e3401092f6872bd053a99b2154b8ca481ea8dcd5f9d23781f5a11

  • SHA512

    4e421c59008ccccc67cada14800bc885f138fdaebe0f0cbd9ae7d398bc1babd1831807752e290ff410993e890d265e14e6867e4040aedc6cd5f54f6692a10557

  • SSDEEP

    12288:vPTJS+naeW9kclFEcMWbHdxZ7GkR2fh/6y9P/YAh7Dxu9hc78:nTJfrW99q4bHdxZ7G1fhFND4Xc4

  Score

  10^/10

  xorddosbotnetdownloaderrootkit

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Writes memory of remote process

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1