Extracted

• • Target

    a912a7975b9d580280600d32647d384da655787e36fc9f471c54d3ba685f0ea5.elf

  • Size

    535KB

  • MD5

    234f239a92ab7202a403eb85697ee1bf

  • SHA1

    3769c30e3647963fa53c0a728275b0897f8f41be

  • SHA256

    a912a7975b9d580280600d32647d384da655787e36fc9f471c54d3ba685f0ea5

  • SHA512

    da1f77f57a95043c54bb51e6830407303f0654704500e759b7dcd503e519aa65db615991827fe8c149b9c9764f34e58b9c13a841906c8942f05be84a7f7e7af1

  • SSDEEP

    12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36EojE:/fUywKQ7Fb1pNL/p52fjQn36EuE

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalatio

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1