Extracted

• • Target

    112.sh

  • Size

    318B

  • MD5

    0368897400a135549c0a2d9d83d384cc

  • SHA1

    29c933b2a8dd201b4aaea73789664dda02c2fe75

  • SHA256

    ec991cf6eac0354077622d016f3408b35372c4bbb44e86bc250bc1fcbafedfc4

  • SHA512

    00216c30c5ab73b63821846febd159ac0be3c5a6658921ce9753c858ff2f83d698518c67283a9b2bea9da6067698b1302b6d84bf65ada476aba60bc35eedd758

  Score

  10^/10

  xorddosbotnetdefense_evasiondiscoverydownloaderexecutionpersistenceprivilege_escalatioantivm

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Writes file to system bin folder

  behavioral1behavioral2behavioral3behavioral4