Analysis
-
max time kernel
149s -
max time network
144s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
25-11-2024 18:46
General
-
Target
0e817a2325c215997de15851152a66924874739eeff5da4b434e5d36c83a76eb
-
Size
542KB
-
MD5
e40d4ba6f6aee3acd39faf65f471894a
-
SHA1
7de3d9b9905cc4fde29d37ca73e2ffcf7bbb0eab
-
SHA256
0e817a2325c215997de15851152a66924874739eeff5da4b434e5d36c83a76eb
-
SHA512
2479a64b2cdcff25f87725f6541921fbb4590725f2a8ba7b4827a706ac326fb6124b6c10ea2635502a79081aa2d6b2a29ffeaaa269d320e281e26bb68a30a88f
-
SSDEEP
12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXQLLp6yWrk3:VB2WCH/eMU9Uc8gd49N94BJXQLL4ru
Malware Config
Extracted
xorddos
http://ww.wowapplecar.com/config.rar
dd.vvbb321.com:1430
dd.jjkk567.com:1430
dd.nnmm234.com:1430
dd.aass654.com:1430
dd.xxcc789.com:1430
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/0e817a2325c215997de15851152a66924874739eeff5da4b434e5d36c83a76eb/tmp/0e817a2325c215997de15851152a66924874739eeff5da4b434e5d36c83a76eb1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
585B
MD5e01d3af31533d3377a577b357b9e31b7
SHA1f1eeb29e94839f8d88a5f51cbfc7fea35b1a78c5
SHA256bebbf34aeccfdc85398c8c260aecc5260bb05b7d9422ac3f19113999cd57ad70
SHA5125237511951f98d261f5d3f8f86d12651de97efe4e1803a882f133560737388067c2e24ef67bb43dcabb00c126c3740a841b6771066516be50acf942e145f4374
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD53dae3592dd3b2fef990112a0980ff18f
SHA1aece525b2b0629584b00321d15e3d5b439bffe0f
SHA256cfb2f8da9d47078a49dac02545d39a5d771931ee62ea8631e349ed0c4898ff1e
SHA5124e64bc3a0cd78ac59833f5cf95b4b8ee808de5e3ece6209470e737c69d21f7095a0e5e1367bb23bfe546babd4b3c11826c0f90b982dce5479ba7964250dd7713
-
Filesize
542KB
MD5ba4978cba2466e54eb0871de15778c0e
SHA160b1f8f5906acc27174a33d5ab83831cedc3cd4a
SHA256a3c582f8710ef8ceb8988a2c38b22ea646e0b5042683a4ce523b0db6cf4cb28e
SHA512042141ee99f5bec112623e9163914dacf263c76b8b275845c53eb53841ddcef768efe07597ee2353173a5f17e50d81f635fb6917d3ec5e52a8dc13118255f8a3
-
Filesize
542KB
MD5fcde40d167e31f69bd6e9c4848add571
SHA120a5255ac43898234315fd8c8e47ea53b199d02f
SHA2569603feadc2010d93a58f537bebbf11fa0abc8018e895928f5244c7261d6f5db3
SHA512837b779e8093a58e909cd880a75e56bfb77ef2ffa432f828b5b5ec62760bd9465c01fe130042e5417389c4dc2fd07096c97f9278d11283ca5e8d3d3c2852024e
-
Filesize
542KB
MD5f5d4b2a4332d064ad936938db730c9b6
SHA127b9eec5681ca6d51ffbfaa8c494a0a50f471d20
SHA256cfb76925d1c499f007fbb8dffefb28480fcb4ddae6e66cf6169235896c5ad64c
SHA5123569fc4a69b69d772e9f414b13cefa0aa1501ca252029ea7f206d08518567beb61867d58aad5bf4ba6692c64a934dbe2c76539abfcd0bf2b548c9010935d9ec3
-
Filesize
542KB
MD5f078295a1b5abfaec9ea4fecdd6d57c6
SHA178b67ade4a943fdd6e5787f468d7058dbe8524d8
SHA2561fc23584bf055d5fcadc7f8200e3b39514a4b9c655ea3b7110705fccf149dcd8
SHA512ae88e4ce1694eca9eaf4f5580d7e43f427226797b3f66a0c7a7cf759ce907c57ea3cd10174005aee7b9a2de5c0ab61a587a99c309d272cf8d95609287ee4455d
-
Filesize
542KB
MD53cf16ac4f2bd95988511a79bfa404123
SHA17b994392d397fd122491688d785057f3b1a047d1
SHA2560c5b9989d43f51d99c90a9cf6e7954f5d075878c3091a08e620d84c751764b0d
SHA512f0a9ec2b530d08b5a386672cb5730ab055c57ed187e8aa6790aefac41f726177375c1002cdfcc3c23543b043a8e5979aad50d6c441b712ba265508b1caad5af1
-
Filesize
542KB
MD5b80a1d57a5199adc8cea3dc10d0a5277
SHA11b25964ce7056fb8804d699da0e5fe5620d4d275
SHA256471436cab1290b21c371bc7de9b1e2a42da84d7292468cbd84283396e3dc1360
SHA51239e76f04271bc9fc8ff26e43e6c1f43c013711e6aa8230e95b10c8d02a7b0b205661abde4d53914d9db36a0db5ede0ef169e3b999655363bf7897ef380bf727b
-
Filesize
542KB
MD521e0aa98f894fddd289c8c99a3b39fa3
SHA1c5e470b9d99c9e8187b7428ef36361d115770a1a
SHA256ae2fbf95b91574f3c3abc41c76882e0a77854cd68253742fbf678a7d961f91b2
SHA512fceb5f465f6c6b291a7b24e77fb961f822963fd6302166c8f79a2d2e6942a60f5ddca83e4df963f772f2209e2e2481e8d7f69890ad913b100be7590528c32fe4
-
Filesize
542KB
MD5a325dca4bfeb85f5f056dca1bba96b93
SHA16ec32ab5ed30c01ad32cb4896e5b52ea5f4845b6
SHA256dcb974f73dd52e9143667758dbe206c8bbd6460d01dca184713dbf47756137e0
SHA512a0fe767d46aad2d18d8c4c6817952b74a12ec502cfe3a33c6e22b5cd01ca672bcbd350ec64250b6e9a5d4d0487e3950d621d5acde164e74d09ce095d52106919
-
Filesize
542KB
MD56e01b134c799fb94dbed02c079ed0498
SHA1e54a4902a0cc50c7b4d1951cc2b9f0db3997839d
SHA25639211bf26d83fcf1d6ed08ef05cacec60e668c0737da997bedbabadc953e0baa
SHA512b354067fcf1f66237784a05ad918559574a1e71ece810c4394428ac4be705ef75205bc4a8ff8c17d6e794743c212a5a26625d10590013c44645d19be03f27596
-
Filesize
542KB
MD532438b05d1482dd0d42e80381d0215ca
SHA1508927355f139859da74c95613b8b440416c4ea0
SHA256b218e035e2b665efa3848b1267db821264d04f6bd6be279bf42c6af7201359b2
SHA5123a5f7dc55d78157aa1acb0906fa7e332bcf6d385ca8b7b3a56fd63e5f6158470008c6a4d53afd9f82386aab69a7ea4692f512d11e35472806aea2da7f83595b0
-
Filesize
542KB
MD5605aca9db0c2f3677784988542cfad49
SHA1b81015300e14bc235e08b527d7eba2596f62e17a
SHA2568e9ee4ba037b94082a710ae45590074c7042db90494f66008378b1a32ba3041d
SHA512871fed0f8a72a7af2117350904b46fd64a99623799974b045765120f6a5fe8e2e1565444e7315fd6ebed9478d38f54b44f952dc22fdc7d96c4c361bd001520ea
-
Filesize
542KB
MD5514e826fed7b96482feba08c455952e6
SHA1161b7a7880e354957110bd53af73d001d81676e5
SHA256199de3f52a4f0a5ef5720c100facf0d8d05b4c0ed0cd8ed0704008b8c98327ec
SHA512f3af2d9b73c0f2e995601c31baf750677e0d199327d46a550627eac1bb4766de2ae93781cd29d9d1ea7524f0e977d5020562b667a66d896fd194694b43a683eb
-
Filesize
542KB
MD5270ab4ebccb4111a8f23feb748fdca33
SHA1ffaeedf2d8911b88cec40fa22c49d3cc26f79fb1
SHA2561df337b390ceaec903232961d33b57c214512dad445d8d81c7415665d14ce3e6
SHA512c630209c0a37167b63a8bd414fbe4f7358a6d61593986b69a91190be0f6a994290515aec90a578464d8aa0a88e2ccb372bbf432cde13ba6741d609c629722734
-
Filesize
542KB
MD58101257a66d5b4f00a2eb9c41e01c54b
SHA1821aa799339dc3d54f04ad11d78e721771c295b0
SHA2560629e824d73b63efd068be8168050e972ac3c3d31e388e6881783be163969f83
SHA51217571269cd859b53d68cec02f3b279a4653390c313d18425aeb2c8a6e54bc360b84442412940c3a993dc5f878b240d3d4583df271f3f306ab27b22d1c7e62a4f
-
Filesize
542KB
MD5584fe2ad4ee79e33adea6ff957e988d4
SHA1819e557863888f403c520aeb58928689482fecb7
SHA2562f2c1c3480ec3e435095d97fbedd27c2f370ee760c00f8dd394f45194aebd376
SHA51221703804a87f7bdcbf4a320da4d0e2e6b77514428a3d786e14a432baf590cd669eba0e3edfc32f2a9bbb7bf00debcef98a130e3a5759c558f95d8d3bd3935e61
-
Filesize
542KB
MD59089a54f726465d2be3324a86a3120a7
SHA13352af35cb855c19fbb1a5fa0ea85d978477eec7
SHA256c5698bd705c14e13dcaeafc08ebbea87e276550c949781fc0a717b5f7f24cc91
SHA5129d31d6e5644298052d9e56db587cf241b76bd08e991e54ba30f60ca757c0ac06523f799b23c9a06366e4f69cbc9d0cc11c36291e92f59a093db4cf05b82e3253
-
Filesize
542KB
MD5482a7d8b0693e6456227510666f776e0
SHA17dccb53019ebc9a70cf0281bbbc849225640bae0
SHA25673702b1c44652cafc5595a2f44a107a3a34a6f188e5d4dd90a850afa7a6cac8b
SHA512d480c59aba47194aee4d7e00b59fe7b918d7e4ffbf0548168d013300de0449b75edbb1c7676f6fdbab8d9fec483cd240c40247413310a106beb835daff0ef69d
-
Filesize
542KB
MD5a79fe83f83e64e8d9763bdac64eb2af8
SHA16104b4254aaab7ae801ba2a73e14b30a05531947
SHA2563d0f14529e3f6174e4e87fb0ca8bec66bfa2fcff19d7512e7c2c95bfaec07fe8
SHA5129e4b3a6a6fbe459a9ffa73ce4f0c58e70b9441080108a33b1705023729c24342c74f6f6d8a92879d3026299801a5b001371773ada288cf454ff2f756855d8546
-
Filesize
542KB
MD5f82fdde78b44ead9f3d26db512c88cfd
SHA139b99147dceffa7c834d5ab03556de682116a0b8
SHA2564882b7c86b121d29b9e347e6064bae89438bbd53fb6a99dc3cd88411677e9487
SHA5125d9e7194024f3fbda5c69344c25f42b28fefc3a036684322801029c5d8f9acf73c38ee6a846c89749f95b64d05d43cfe0f0b102e908c1fdfa8d738f87daadf25
-
Filesize
542KB
MD539777f69dbd209b904b75410bfbf7bef
SHA18acabf6d7191a81a1a1dc0ec59395efd7146c18f
SHA256cb6577802891a394050d4075959721356deefad1dd48066f2f44f27fd5f129f4
SHA512177ee06113a4f37d4a4179d25be25d343bd8fe8f325aa3488e127349f4f1dd8f91c22236f1b5eb66097871a0e054c23b86514b19a507193558cefdb0c36dc2d7
-
Filesize
542KB
MD52c7eb9a0dfc25c2b9f2cc68dd11de1a0
SHA1939fb8285e1afaee5dca763b328a645f1414a300
SHA256cfcb4c6c415afe9911396c31f754982f5b7fef851e63b54e881bcb366ff39f24
SHA512ca57d6c8be045ca009bffada3b948df1962c2bf624fd0e2d3fd011955147f3ccc6987535f1e74fecdb8a532a5a0ca307d7f44138ea8054ee954cbee087e565c4
-
Filesize
542KB
MD5987fe00e5b75669bc5a639795df3260b
SHA1c6f8e5db17ad07ecc788f4df63b7f7107b581892
SHA256ccd041ca65cd6844a889c76428cfdf57044d0dd1aff155beff37d43a967c4e5e
SHA51203d345cf568ed6c69d0d9f3165aad5ba0822a647ff0fa278523697abb1f9bb513022ce80a0583adf313d873a3c88bf1826457870e338d2dcb6fc02c3de0fc88d
-
Filesize
542KB
MD53c3330fabf11b57eae924893bc0ea959
SHA10dd5149c33f99f30e8dc98a78045e111e2002e7f
SHA2564f2ab706b90363233fb21805b1386dd7dcca6f310c9d5b446146c0179f9b31ed
SHA512c1f6209d65ae50e00acdd0adb658ddf2f6dad59079e9943914767230fa8dd8cfe8bffa9816b7fa3ce7ad89ce98b3844319774f624bcecbaa600da7abca9b5e9c
-
Filesize
542KB
MD5d4c78ab71fb3d2b030cf48d272d4e193
SHA199d81a75faf26576d60890cdb2d1af493f0f8405
SHA2563d64e428d797763409af9ac902a8fa10b28c16134f4f41e40a21def69c3f053e
SHA512389116f0f5d1f778cd29a284ab9618228f2a6bcaf792848f8ef1dfc02085b43f440d8ee8f3f630ba20fa9beee156a0915f7c5cef47456467bdf90bdde382e82f
-
Filesize
542KB
MD530aebb6a758234c3f71d9d44cb3fd6ed
SHA127e146f82acc83659ede6ae01293e0db3c67db4d
SHA2566f52f2f64bc189c93c6ee740edf73f8bb5ab28faec3521f9444a98bcbc104bdf
SHA512ecb29d28e6112fac3bc4e776ed273b7393402d87fdd80ac18422ba0268dba48de5fda1c279d40df336c5f395f79603524e1ae21773bbcb4b87728b5b9473d76a
-
Filesize
542KB
MD5f16276e5b4c70b0ac8c9becd0c386f3a
SHA18568ee2367e87b6d354cac79b1e114da361a55e0
SHA256a6c539680a7cbb2f8298e2588bed61743224e9796d9d3485643ea611a035965d
SHA5122d83239881d657f99371ae8366eb975a6acf864a74d6de13512e78add6fe4a102f47de7c11fb13d2bdcb7a8613f3a2593eaa71bffd211a58d0d9b971f830f1c0
-
Filesize
542KB
MD5c7611b95d32a1fec8c1cd528edb835a2
SHA16de706c9cbe7a145f4ef09a79b3a0a1088f14dd6
SHA256ac46280990fa64aa3e6316f669359e9ae2329e037b1352e7cb5a41d6fb8f998f
SHA512de0e86e1ac08d1be6ed53fe1ab75eb85e7d4fde0665d1e51c35532cc3086151314c9ed3858467528f67b963378e6ccb9e8136124f04dddcec6fa5e8bd87b5073
-
Filesize
542KB
MD5340071c5c05a56671feefcc5b2c34119
SHA19dc6c85d705755ff5625445b30bc669dfc2e0187
SHA256885a2ff93dd7c8fb79f417793d37c6390936509f1e07f77b1e130376316abfba
SHA512487519157df8ab4e64cb2ab52aad653aca005e52babea96a4d484bae373284b23995a6b492dcfa3a0a88ddfef86103679e51f3c6b33761e270a130c13fa2d3fd
-
Filesize
542KB
MD537f1f96fcbae1f87b842b0bc8e313ea3
SHA1ef300cfd6adeb4c96a7e7a27532c3a4d4bcd047f
SHA25609c21cee050efe6ccc4a7a27c45cce7560aa8e794fecd607722b0e2ea8153a16
SHA51297b4d0a13c0adc3b326660983e71e9cd399c37c20f9379a3f13ca1581ec8b994e44a8acf754bd3275947f858deb2f5435428218703d830d1c7f10325c3569aab
-
Filesize
542KB
MD537dda7731edf292c32c2d08af0c07c14
SHA1b19f44c73ff7bf192aca29d71bbd7b39bbf05b37
SHA25641d1b9948548386f981d85c359d209cb03aa76c68b314aece048eaa1f8b474cd
SHA512f94691da7d91476af4aa659cbd50b8f169d6fa6fec933567a73de2b8c219b8090360180956a598c12c14dd0a31d6d3253ddae201debadafd729bd06766cd4ff0
-
Filesize
542KB
MD5e40d4ba6f6aee3acd39faf65f471894a
SHA17de3d9b9905cc4fde29d37ca73e2ffcf7bbb0eab
SHA2560e817a2325c215997de15851152a66924874739eeff5da4b434e5d36c83a76eb
SHA5122479a64b2cdcff25f87725f6541921fbb4590725f2a8ba7b4827a706ac326fb6124b6c10ea2635502a79081aa2d6b2a29ffeaaa269d320e281e26bb68a30a88f