Analysis
-
max time kernel
149s -
max time network
155s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
03/01/2025, 14:27
General
-
Target
309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf
-
Size
535KB
-
MD5
b942a12b9260eff39da67a89c096ed34
-
SHA1
9e85eda9b6bdf0232f4934924e81b90e15a55a30
-
SHA256
309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55
-
SHA512
a983ecac632d2693403ebe77f19c86a1ee5ae90d1f37e1d685a607c9b939f3d6b7c12507a2eb8f48e5e5cd8bf4aeee601fee9357c226f11fb35b491034677e59
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36Eoj9:/fUywKQ7Fb1pNL/p52fjQn36Eu9
Malware Config
Extracted
xorddos
http://aa.hostasa.org/config.rar
ppp.gggatat456.com:1522
ppp.xxxatat456.com:1522
www1.gggatat456.com:1522
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf/tmp/309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
605B
MD520358bb17e71b1949ac27137ccc943d8
SHA1c5ea1324408dccb98a25349872d23821b927aa63
SHA256081dd1e0d9d63884c269929d877648ca54bfeda259e57a5b3c44e9507ae688da
SHA512564d86cbec161b8849808aa70b10037658c88b509f10b7c9b45b986a5e452d5d75ce8cc04ebaf1ab8ae867d356219ba343e8d71bb193f30ebbeef2240e3e0b9d
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD5f62dcbc6d1fb284c1c232781784ee963
SHA1ce3bbc68f0607b00bfe5f5fe8e5cd083540ba63e
SHA256ed62fb0f92fbe6178c5c9f0254f9bc82871f1de371c08e0b733b04c89c636db9
SHA512df8b8b3fc5e7ed3c23a50f594e7c1f8e8c894e1dcfeba81540aca63f37e16a78578e4cbb59de125d1d68c3bac6f5888311592ad2f5e6f5ad6ff9833b98b87e60
-
Filesize
535KB
MD5c10157facdb0bb2e8950f08fb3b1e7f6
SHA107531c3b5ad50a760a8a8d3fbae9299c7351b31a
SHA2567ee65544d53e2dc9aa82830ac43e5639cb119f56275bcb0941750f8a232ea480
SHA51232342825908752a35e6b123b675ba72b354f05c260140ba4ee231f88658b6dc9efb76c88a43408a0485e46c04f61f36f18a3b7be7189c9590d884800aba8c24f
-
Filesize
535KB
MD527104db64b9178551603058c2beb1330
SHA1591dfc0d9cea11837b575e98757fc4bdff5417c8
SHA256fe46fbe6cd79075d9fb6f7b9e0114a2072f00130f099cbe436577afe42931f9e
SHA5128197a6e1f122dcfdc2a002ed297629a8c45e4ab875949f799000107d10840e64a38657bf6dba5d46cbc0c1f40db44492f37a3ef10853af17bd0af89758655db3
-
Filesize
535KB
MD5f9f457516b212eb14a55c67e40d9e8ba
SHA181371a73e1b41acea4f82b717176f4456a260536
SHA256eb8c9c541637ebb94cec51230e209a4f2d6650ec2fa44c267e395146a39d80e7
SHA512713ec4ed8d3621b967e4e759c0aa5a5063704675a5a74d836c1feb5e069198c2df9937f08510f274a7242ab54f767dae6dfe05d397bd795a05f2fb2965299c5e
-
Filesize
535KB
MD53531f6c5565de4b80c6b70693e094920
SHA1a43878cf9a727f2d1a39d8661de9c082dcc76a3c
SHA256da992418496562f25e6de59f0cbdfb3ce112bedefdf835d79accba3e63a2283e
SHA512fbd9ec25c5040d5cc86096b993eba399e6f85bc44ac5f8db085051d43dae8abda17791590f999791b63f2cf14f9cc94754530d7ec8b1ac866a893c852bf7f1fb
-
Filesize
535KB
MD536c6511c623b2a99df55228932b40075
SHA156b1e349d748cbb8319dcefa015ca9963842f40c
SHA256cb282907dd1471967dcaabd2ae8ec0f6215d00eddbf30f3f2434788121dbd516
SHA512eb0a442b8c662dc0749b5ee0d32d075a3e0e3cf1e6976992b8d0614fa55ae035816f0d1b6996fc0a09f5bed7cb0e80c9d0030fbaaade7c0f901ae843dd5555dc
-
Filesize
535KB
MD5903ed9bd34c062d5222028b3ae484a16
SHA1aa1bece870c4360237d610b282af6a31d7f792d0
SHA256a0b983d545a3ba27c05b0afb06331f8dc10671d2144b6637c404a911b81fbc17
SHA51251324e75a31e955f6574884676fa4b1faa2acc766f5093496eb503fafc426f4546cb62ae069500a937e7051eb64135ad0ff4af038ddf6ebce384a13d4abf86cc
-
Filesize
535KB
MD53f5e7a0f90d05b5349e171d7138eba51
SHA1e53847ca2cf3b83915e1cc02a7ccd2f894a7dde0
SHA256f1de355e0a4e062a45d58b4ea64fb06766ee93d5f2c97ab92d85d9da7bdcb44f
SHA512cf0c93b82ccc01e8502d83425e740c7e0a855b779bb5abd0b73d9211f5034952af9b0efae7d37d22c3c737b13d5e9de7b77dc2d6ce248b122c0c710767f0680b
-
Filesize
535KB
MD5cf16d5ef1f5749c838d4c3dae718a226
SHA134f5acaecb04a927fa787124fbb1b44a09daa340
SHA256af0244bd76eb36cb093780698beda27ac0c5ad0cf19ed7d89b159ba43d8987e3
SHA512c74cab29ff7673d898582d67a033247e666278642f3b90ad74e90d2eecbd0ce4a60cc743a85d170fb7a2b91213266a4ddfda7846115ca80b7e37225ac1fa4151
-
Filesize
535KB
MD5fecf9334db29e42ff1549494e3c1351a
SHA174ccf19f779cbd3fbff1183ea43175288cefabae
SHA256d4bdcea148a0d5af33ba7925a4830b7e59aaab77825d4ff17726e81a814cedbc
SHA5120cc3a6561d923322e41f502bbb7d20da4f4092a15952d1eff696afe542eb1b12d2d7b41803aaf490f3863ba525c9d6686e9c807ffa43fd71ef3278c56d6903fb
-
Filesize
535KB
MD5e18c89b3e5c57309d6cefb216f34b258
SHA1fc885ef1ca5954ffe779363b66fcf58aa225bc1f
SHA25623d4f8d2c4e2d1d109f32c4fb9323cccfc1215fa19aaa916623d9533cc5078ae
SHA51250c5870eef480549e3929569e494ba2d8b966e633ee80816464c6ab1cc7ad0ea752e8d67a7b42e29d1c57980da093784e29a6557c484f71065ec7420bd8506ad
-
Filesize
535KB
MD5149300d391ce676e920d6c213d4dc306
SHA129334e675ad0db85030f9b153f5fea96d1f4a4bf
SHA256bf5210ac8b846defedc1f6671f932bec5446747711cf1a1bc74d9c6f0e798508
SHA51275b5547a012da7efb01ffb50a8fae065df52b70a0de184a0315242aab99408a4137205692245c08383bac35a2f589efc68934306487a9e8bba305f04e41585f7
-
Filesize
535KB
MD5fda97090c561059a311a31588d2802be
SHA124035c9489f19b43029ab371a187ef68df1ab8c9
SHA2564ddfe6a2a7be247b6826e132d91a860cca7cf5d6cb669cd5c5fb3b8e427d1c21
SHA512628ffed5ebbf0925143105b79faf948bff228d9eb1fc5cab9a06951627e036afad7702940cc6cfcdae1e549474b6f08f71f6163fabe2d8dabaf432642288fc5f
-
Filesize
535KB
MD53a2f6a767746d6b39b748f6f50636460
SHA1f14ba0afd1676dad4ddef967284f00fada9c7eb1
SHA2569a92069044def1497605cea14cc4e9b12751eee9e7fa83888a6ce382e0a1f0e2
SHA512009f6f227b00b476e48fea56904eb94cc6f7c868ab4dddd7c7194d6fda75ba9a99df61b91705b4dd8dcb41ad6fc29710fdc878a0c36ee9853157c08f318b3cdc
-
Filesize
535KB
MD5e4e3652e90938e390b67c0dd87d6070e
SHA1fcf63d6ad9bac027564531b74103456314b3a8fe
SHA25695694feb475264d0370ed0d9a4cda563cd7ccb537de5b0c178489fbf666ade28
SHA51208729675e0e8d8bb6cf8f02f2ea97ab765da7c13ec5bda13b3d0581e6614e4b7c877038da6a6d49e841f7291925d31bbdda9f33f33781f2d6002743f7ec4cd69
-
Filesize
535KB
MD5c4bc2635faa52e362d2ad486d2148508
SHA1cc537fa82c6ed030efee39e3b93075c2411c20be
SHA256d04a028c7b61af909c982e11c3aca18a920ee1d6f991c3a4fa86e1fb470172c5
SHA5122a0f8dad7e652311e877faad2357820a4af8e0a67e1d55bc7c1e209f398795974630785325d3976fd603c52ca96d01d8e339d61ce6848f43463f01e10db5e714
-
Filesize
535KB
MD554dfea8ed8b7c3883281a5389e1419b7
SHA1b3aca036c4756e3cc9063beae4fab3a5e5aff1a6
SHA25662702af5790af2d8d03cfbc217cd6f325bb2b8c75948eb035efec2953d1bb6c0
SHA512dfe4fbb8f570dc58920e8523d894ce5e7e65177fdcb7339dd283fb90dfcd060c55a4c39f9dfa3cc343da9b73eb1c8cbe2107932beed6c959920da9c52aedbe63
-
Filesize
535KB
MD509acf6398ad8cdcb715a1221c0b52641
SHA13b15b6d480d169a975f956ded908777d808c7d74
SHA2568f6e9c4a9b3273fc50f1ebb07c3caacc487ecb44afe4febbb841d384163bc7f1
SHA512395a59a0579aca9b9ad4b2772d6cdd3aea4f869cc278e8de6bb6fd110c587a3297f726798fc6354e16b2ab3663603a5ad54956237edc9ceb57e070092c327253
-
Filesize
535KB
MD57370ceedd61b0c4faa1177dca5d9c873
SHA172b0ad6db669ffdd37aea898d6a5d301c8b4f3f5
SHA2561a7a50f69df52754acb4f99e51e85bdd6a36a34c2439e69060edafadc7443304
SHA512e7f15994f4476836c6420583cd9f760941c9cea4a8767bea75a0c13c5dfd977d3c82bd6258f366cf1ac5312a87a21454063badddfb110079abc978e881542549
-
Filesize
535KB
MD5261529b4d0e6a3fb788dfbfa9b259b3b
SHA18f1c7e53a2132e4401cd241e6d458f3009905c2a
SHA256d86108e0607a0f553fd11f54157fe2600e6288c78530117f204c4c47d5d28783
SHA512c93518d8257893a56b38d4585e14da5d0d54ea4c763fcccf4204dfe1e952e53c8bc6ef1d9e62f2c3f6f86e131ccdec955e98a160afd11cf2b6ff02c8bb0b1da9
-
Filesize
535KB
MD55ec467c2471bce73c802ded86442c9ec
SHA100f846330d4e345ddaeb56a5bb430e8245927e9d
SHA256a2982436f8ee57fe4adc50bc14959e31ecee9baf7d4e523acea97f8e2ab788df
SHA512e5e84a84651fc658f91277f07b3d4bc8df86eda6674c64c4a60842ef170497aa41d0ec4d7603e759c4ab962f56c3ea53bc219193390dce56b9fdc02f271614f2
-
Filesize
535KB
MD51db0e2a0ba50592cce3dba7e4253fc91
SHA137b6a122812b89b0a6ea0b6cc4962521304f6157
SHA2560ece879298b596f278653627a07644ae5e82ae32cf3952c586c9fe3d2b15f77e
SHA5121057fdf705be17750a64868b282c00d705789b5479dc8999c289c5ffc0c2950d836f67b9bebf5b6e5c62c8842c063f791c7f3cddb927635baf872150d0d923f8
-
Filesize
535KB
MD5ee80765db4947eb8260f23fa73e25b25
SHA1d4fef6c155f3469971706258648e8ed9a7e6b422
SHA256138800887476716d228b574bd2d9ab9cc5b270cba1fdc90ef41ee90d21c478b3
SHA5127772e20f6427e434d888275a8dd7f366fe8ab23c2eec8e3dd47148b540a04c634bbcdb11a9fb623255212a0292e0c846d9d5feda6562cad7cd36797620741725
-
Filesize
535KB
MD5e8e983e04689b8563129064fc4b3fcf6
SHA113d57a8fa7836c6ab8b21969e0d9bcf813131cf1
SHA2569710a7e96c7e4a7cf34fb9ac3ef04d89d321a4084b7e3ddd3c5f1fb625663a63
SHA5125305d939348fd889b7189bcd2acf39251c57b7fa9a501fae1726292d27dbcbebd9651ba25adc92b3725590f1e817a67f6da7e7c9f4d06853559a59e805d40154
-
Filesize
535KB
MD5bebd605a0aedbf949ba51fccade681c5
SHA15566b66cf9eb684740f51eac4d4571005791e71c
SHA2568ad43fc22d4dd0205ea591e9557000e50b9dc6b86c995b30eba0246f75555397
SHA5129cfaee6ddea2bd7e4466d3ffd29c360084a69dd33e371571874e9339344843e35cd35f3cae135ad0c5226cf4ed8ece88c2eddc1288775bedba8e3c0cc71553bd
-
Filesize
535KB
MD5ad741107a317530e58de80413265b2c4
SHA191c6be47743873a93e1e05859f865074a81812b3
SHA256f76346cc85002fab5f8339d266f842ea4ff8e5ad61d149b9e9054b1626036df1
SHA512a468c3bc14a7a7f3ccf068b2d47f41bb2b1590c3f6450a426b7d78ceb2354c03b311ca1cb24097b3ebb8e903237d3631aaafc8a459672bbb77afef3445d4fcb2
-
Filesize
535KB
MD57624f515f284f73d42ad374be2ee251c
SHA1f212a749fec4cd5897f11ca3e84925ef8dda7e5b
SHA25689f9ce6bc40614cc00d461fe6f2b6017b3cfa00261161920d7a00ce72bbfa000
SHA5125bdad54231c9c39dac4d53f048e7934bb48cebdfc34c746f4e5f713bef39c2df283430fc49a860b0641a5abdf6257b4e2daf29744306fdda99d7548788b5d66c
-
Filesize
535KB
MD51869279aed8a85ceb210c54975b948f8
SHA1cfe7f026ab35f6df380bc7b8dc31e2d22ebd6b20
SHA25616769b9877124f54b27fa243d264d5c5326f3119201d3b326d5bedbd01dcc338
SHA51240c1080af0aa8f590991367070f4f973efb4ac96bedfa02ae8947726c578b0bf13bb0e2550ce8dd3e041566d8f9599cbd2e3e1a395cf5c4c00ff8d3180b75951
-
Filesize
535KB
MD5fcd140fbaff95d4d40e82e45000692d0
SHA13cb6d22ed2c4f64b87aa464bb8bb7aac0e3bbede
SHA256f7abeb469ab503a7373e8e4413d46821f637985261d1f97f6b82c00ddf461dac
SHA5124f49baaddf1bf54ad0182bcaaa96d29b5daaf4f4a96f4275fde16ab41012776decdac0b3d61d301c1cd534ebd966cb7480a6e25618e1734b516c97cf4cd98b82
-
Filesize
535KB
MD51ac7fc9e867216364b1654b738660886
SHA1f1e8a5f2df953d696f7d8bbd53a6d29a02d4ffca
SHA256caf9e3a82a3890e2be8a1048600946ccaa64a8e6d49c0255516a4c01bb19e76e
SHA512f770ab42e9590424cbe3934d942f23046acc90a13a72cd7c86f26911ee07f9b0a8c0edd85c51c1a6092ba2e39054859b1364a68310cd250958e9650471f78a59
-
Filesize
535KB
MD5bd90cd7e39ce8c83a57cfeb69dbd79c2
SHA174c3e40a9cf3c2dde49345c4c318fe70011d16a2
SHA256a6424149d0a20650602d3fea4aa0b177b285101ae1c44cd9013cde729fe31a3b
SHA51222843e311a6b9a1e16f3c43295ad4a44dd74c3f622b8ef6c0646f80c28d6289a4142bb0e6079d67b22204a2ae63cb15f69208eebbe963ac1b64b557cb65c0102
-
Filesize
535KB
MD5b942a12b9260eff39da67a89c096ed34
SHA19e85eda9b6bdf0232f4934924e81b90e15a55a30
SHA256309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55
SHA512a983ecac632d2693403ebe77f19c86a1ee5ae90d1f37e1d685a607c9b939f3d6b7c12507a2eb8f48e5e5cd8bf4aeee601fee9357c226f11fb35b491034677e59