Extracted

• • Target

    309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf

  • Size

    535KB

  • MD5

    b942a12b9260eff39da67a89c096ed34

  • SHA1

    9e85eda9b6bdf0232f4934924e81b90e15a55a30

  • SHA256

    309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55

  • SHA512

    a983ecac632d2693403ebe77f19c86a1ee5ae90d1f37e1d685a607c9b939f3d6b7c12507a2eb8f48e5e5cd8bf4aeee601fee9357c226f11fb35b491034677e59

  • SSDEEP

    12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36Eoj9:/fUywKQ7Fb1pNL/p52fjQn36Eu9

  Score

  10^/10

  xorddosbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalatiorootkit

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Writes memory of remote process

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  behavioral1