Analysis
-
max time kernel
149s -
max time network
144s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
03-01-2025 14:27
General
-
Target
024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8.elf
-
Size
535KB
-
MD5
605b7525cc4ce173ea4a1575860e7487
-
SHA1
07d243a73fea7a93f2d43890dbb7116f2467204d
-
SHA256
024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8
-
SHA512
ee6cd529d27adab0d5724108cf40e69be08d717821a11432371f3665847e4a4a12f0c6ebde8712ced643a0339a34050630ec097c62f7f0193a470ce488da6cef
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36Eojp:/fUywKQ7Fb1pNL/p52fjQn36Eup
Malware Config
Extracted
xorddos
http://aa.hostasa.org/config.rar
ppp.gggatat456.com:1522
ppp.xxxatat456.com:1522
www1.gggatat456.com:1522
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8.elf/tmp/024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8.elf1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
605B
MD515c712e6097c28d202879434d173154e
SHA1fb17d203a3ab980a439c4a633330ff14bb534dc1
SHA256452334256837c6ed567a89b93789f3bf8856195215abf4f97abd1dbd73ce1c55
SHA51280ec64450b12eb70a741eb6f39c60efa7e5824b262965a8e91a3c39108c7e73aa2cee2214859f98bfde69ed328b0a7e8a9dd6de884bafe7ad15e6407aea419d4
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD572caa0b77ab4c3512e2e7bb9996d790e
SHA113b3c72cd39e9a3ab1eb72fa18b2291fd69ad52f
SHA256a3aa3c544eca99cf6906615c6b9bfa8278be9044f7a576ba2f786b196859fa1e
SHA51296f84a9e5e816c5ed8c7a9d3ac4e03bc75907158a58e77199a9eb115e00ac7ec260b4d97f03abcec774a585b2d8f485a9392b9c917e7b1486bcb8a7a7843d1e3
-
Filesize
535KB
MD5354be58a4654c5a52ce3136879d2eb6c
SHA168cfb6da500309320bbb39f6f179aed4aa198d5b
SHA25645842c3132693cebf0a41cb0fb1b30f233e0c4ead019bda1cce2b739c28923d8
SHA51284a5479ed354d9ad5245416beb574b861c131486df5452fb211ad49555b43d724c9b76ff7ec4f207c75708be187f35260a8d01da8b3e140e56f7c92675eeca57
-
Filesize
535KB
MD5222b9684e6c7d748d6a1b159a8836827
SHA1f1fdfd161a5ac716c92e7a16b9e6a0760356d3d6
SHA256235db9240a3d09f7c4edf3229bbd10fb08d050c75826c1aa663e07039473e106
SHA51200e3dcc5a904d95c847aa74a48f73ed6f3f7497a4b4e6449550ae52873ca36588866c92ec9a524edfc0900a5a663f08cab207df24abefc485b98887926588fa8
-
Filesize
535KB
MD5284781d09769f51febce994480a55174
SHA19c96f8cee144724b35b4a1fc5f45a516502215d4
SHA25607104e9a96c1bca1c8949ba8d0c2cebb74e509512c03e2b5e29f33386ff70661
SHA51292a91c0351b06df4ca7be10460d6536b18d8f6fc3221b19fa17cc57c09d8418ea174a24deb897b1fbc43a04e994899e5c47dde91d420400ecc10c4e76de3fbfd
-
Filesize
535KB
MD5ec9abb1577377eed36674520116917db
SHA1c0aeb21dfa275a6d61380b842333388035303f91
SHA2565ada6f7e566a837638274bd748976145cb4ecbb1c73b49f7828f37b432448a08
SHA5126d11bda49dc9539239f9a9e75978e64d7608c00c97d793f2f1752e06541def293a42eb3eb058cbc7d07ff9dfd9bc404545ee18a35357ae74e8ae222893d9ba62
-
Filesize
535KB
MD5bf8baeff0f76ff94b96198d0655c601b
SHA1a4ca3118f917318564dd54bf1d59c79aa4c93b00
SHA256a51d68fd29dae81a822d0c245fffba342c0c56bdedd5a90d5c9d1e24205c19b5
SHA512ec262200501f5c9b16e842e4b7a129f419941b59f114a6b86070d90c55f91b8b3db68d087bfe53d868b4a44633f197b94afabc61af9b2a229325cf5fae6afaa2
-
Filesize
535KB
MD5ff104d10439a4ee119b332b024c2aad1
SHA1ed603bd9424d6848183ae9010413dde3acb6a07c
SHA256622f3d6097c66a58957927eca54329c2bc704ebb8f0b321f437085443e66ce3e
SHA512310e0d15468b29f8af1e393dfdcf5a264e0c45ad27b986625add71da100c9780e5d0e4397d4368fd3e18357527ec482d482b2850a1c78532e5a40810bc88b5c1
-
Filesize
535KB
MD57513aa4db46cda01cd68ea51e077d3b0
SHA1e1d0147e6e638bc444535ebfe3cd6973f846eb4d
SHA2563816f2200b764446778fd13b54f6be370eebbd1485fbfd845bebbccf98f27b8f
SHA5124776b353f7eb592fbfd58419ca50330f25f9b86f7c163ab189279e9e6742137c24d98c11b4093769c14151d690be81fbcd91012a83bfd110e350f86e6ed3bbaf
-
Filesize
535KB
MD5a243ba433ccafc39cb1d70d2ea050b79
SHA1b17417217701a2315d804a223b062b1874e4a43f
SHA25677fd7d892e3c34aae58ef1516f9e52d8bcabb2abe28182d7a8ca44114eebe704
SHA512b5936e5edc0c7a49454cecd2f72fc7b09f6ce57ec0502f6b68de65e21e6c447d296df4de8e4cf0c4b2f21c88378cb1e8bd29e82da3efe186956ed92fb54b74b7
-
Filesize
535KB
MD57db7c5aec7dc3aa60a5b4d3bd6f54fbf
SHA1b59a31c67de1b3d778d6173df822351d89b0560b
SHA256e536ac4593dd47db6bacdeca7aa0dddbfb77dd61dcf30994e7aba45d7a079802
SHA51221b1d376f34711435320a15b3f9204c3dc019bd24472ea5c2e728f1e8359668ebd483aa4bcd50063e76bd7352f84d5c8d319086cdabedf4f04ce7fed98d974db
-
Filesize
535KB
MD5b23d3264612bf78c9f591bd35d80cdc3
SHA1a06888d6b1a5d1fd93681b9b3c34991f3616acb2
SHA2563e07dfd7f574b0c7bf2ce42906e3e2b1dff2b2ba55131462c84a468f5ab10d7e
SHA512cce5b00ef8229aa553f3d2cb2a95814d84eac22f95fead973d9cb6991e6cc241d1ddd34d8a78089270ba40f90808f3b18037ff539d5f2c296527a3b73e4b174b
-
Filesize
535KB
MD5e336ceb94529b18b02168f84f1774c89
SHA1423d43efe469a68e7111cec3db02fa3ccded8116
SHA25638e4020359f42e2b7fe195cfddbbab4398c0169ee4e9c5063b79f79a1bf3afac
SHA5124fdf68d1f6240468bf519982568f643d6ea1dc7dd0c7de3b69445ce1fc853131ca7897a1eb7f1b5f4534cca1172bb290be8a7bc3afae85e8dafab2227a949b87
-
Filesize
535KB
MD52f168348676eb81eafae952dc7a321fd
SHA1063b78ca885d3e654c430c81a078440b88f8e083
SHA256b964b34f2a32e1c19dc6df9216631be77b674be4b8b45b393d78c89a203b3726
SHA512573544b9693a42c9c01da4d9f2dd218cb0b0a78e9c06733d55bc21ebc0a678838e92956f8cff62f59d0489b0c778d85f38212044d185dbc6d32652ae712aceb9
-
Filesize
535KB
MD5347abd592a519964c596390b2ed3b202
SHA13cae55a7467a7c1543f0d4ca4e3eb901e5330d53
SHA25673a4562707acf6880b2c63e09f2087dc8da60f2c67ed18a00625d89467bb1596
SHA512701da52d5ad9f0e5808c9d7df02c6b8c20b83eaaf3f3256a4d5b88937dbdcff96d8f9ea2f758921b39c629c670cda13ad3124e3d28dece7630dfe340bb1f104f
-
Filesize
535KB
MD515932494aeb8aa1521cf3e9bfa87ff3f
SHA1397d63a16b02a2fa6f4c2d4c3cad95462846d9b4
SHA25630b02e9fe2daa21ba38f17ec429c1b32ba89fb84c5af071c82b2d1e98db0720f
SHA5123351007467469ca76aaec474f44e199797c5b398e8bb7e70b4d6edd4e37217b97e9b8317354d674014a7a979c601d46da10770be57cfcd760106a645df7c8d63
-
Filesize
535KB
MD5e1ab8fd27053bacacb9e62e3f1be3d4d
SHA19713e362cbd2ba0d3fd23225af28a4994f1908ad
SHA256f979d536eaa65f49215facddb9254a6c9428af6f91e4182281e84f4811b03ebc
SHA512405609beb12d97d947e1798d1a8f51e413d9116d8c2260f494991a641cd8318cd90ef6493af7677255909cb48b873eae2b5e11b5879adec3fb9a0ba2bbe10371
-
Filesize
535KB
MD53c9f8e9608e2ec20f6d0a6ca5b079c0e
SHA16ee1bb4bf54aea60a796dce2fecbac3d87de134f
SHA2563e6d3fdc213deb21547615f54c31fbce9862fba28ff3cb625a4cc44efcee3e4e
SHA512d9284110697f090bdc3084a06d6f47879ef9b36028c0bcb0b09a8f9ed621abf4f2b2b64b2bcf3fba84f3a5b7d3f712e944f7b93fe628f8bfe532872675890f72
-
Filesize
535KB
MD5cdc964cdbf2d196c787c9b59219bb0b9
SHA1b1ea01f66f1fbf5794e2ae2bfc8c2232107b1298
SHA25632c34400567ad06ac17e2f99f08d362e024075e30388ca4195bd04e12281bde2
SHA512a9b51b5c4bb493dd786d9e130a95dcc40613b5a62c1a4631e474e0bfacc50e10cfe227ec2e034ae386f640e0186eeccfa249ae73fa2a88c6fbfa4f097c6e1504
-
Filesize
535KB
MD5ff595fa59816ad734e7994849552d9c2
SHA1273edd2b454a7cb008bf6f65ac49cbdf473a47d1
SHA256c26c38214fbf4f723435f084c4e57255c1b996bfb03964d330c019a20f4683b6
SHA512cbe2d4fc5ff9138e023a9a792a4cbb56651615d1924c7354bd199abf234d35c82fe8a005cb45e2fe635c32f1f6551f2255ab1c19f222320dd70679422bd13e62
-
Filesize
535KB
MD58f00948d4cbd894e50b3b7004834571e
SHA19f21fea325823dae6bb376ec25a2f9e8d2907eea
SHA2564f7e88abdf4a39687875912b483ad54df9e20062561e232a570f376725e5bde7
SHA512a2db3f723b1c38104b50ce45212780d712683e8e2afcd8665c645524464530f07716ff1378e68a8420fa3f1e2d104808d5ba9769d0f52db210bb8c6581114aed
-
Filesize
535KB
MD5ca32085062efacb8f251991c4716a7cc
SHA1ee706f241d86f3f5fc6fd8dd7f19b259b5762a6a
SHA256e29687e2fb17a2766d9ca3a457e07526da8f8c0da5ef4ae5b255e174ebfc48ea
SHA512841a8b0487fb1b512df66756729430a7cf935487701c68906fa857f6a8bf57094be117bc0ebc8fde80b80dcca5b7ff96c1924139653f5e836530bbe1722c738b
-
Filesize
535KB
MD59222a7489577a5530d84f2665bc502e6
SHA1af73580f6791746dffabefcc78fbc819c4dfccad
SHA256e857c7dbb5193e941f0699f0e201bbec6815dd0ed04de4c43aaf9009fbf3bdd6
SHA512b9a47cfd8b91a9367d6c445cb36f5d64f88e5417813f92a6bd21d673bb208903c3e042528910b060d44b429002b40bc27a3b804e91aaacdb7565e4c14d81dd02
-
Filesize
535KB
MD5b75efadc5f5ae721d46374c51db07967
SHA11b24732d966ad6ca7e8174523462836bf58fba1d
SHA256ebdadc68aa276dac1e2a13605f64f7d9b9cc840d34f1b562a569746f01ae1fdb
SHA512793046891c2206062af0d179a7dd46b7e60e60db17e9e925f455dca5219a0d3a5c9d940e2d679cd7c223f3a8e8b2f0bb5b4601d52295bd305c84ae9d08a4694f
-
Filesize
535KB
MD5627b3a90cb6fe020bcf72b323604fd57
SHA1ccadd18c9907c9ca41a52bb114fe19738c002a20
SHA256ba143029820b84b1d8c82caa3e297725fe7100575dda692f66db1152703ffefa
SHA5120e5cf11754f543820ba24bd73e12b2df30f0f574cc2d47578d2f43a4ca4463ec0ca69d9ca5a567529fded24a24fe2ee295bf4a89d9c3af5bab962864c5c7036b
-
Filesize
535KB
MD5d7d013281abf77a23e353515c5ec3077
SHA1f60f49cab58c13fb03ed675451abb8f46192cc91
SHA256dfa77c607f62b05aa4fb85f875c509f82cdade5608e3b0dbd31ba28117a70d44
SHA512de8fc34e6e8e26b52357ac94fb2fcdb39a03ca36b0ef4a1a1edce9be8361d4ac62c93d377be1295d1516fba3a3affbf49a6e58edef3b63d801413a80c0e5796c
-
Filesize
535KB
MD58831368694eb9bcaca2a9db1b70ecbf1
SHA1ba88dab32855e1091d73ecc5f6bd8324ce2a4e5b
SHA25662a57f9ff785f4a1ab8ce3213529c67e1c1bbe964cd48a68428349ae7029a974
SHA512c6bfd2b6a294daf3cd4f591189634a946d36aa142103852babdbbe71278a5572e2358d46fee8683ef0227686f668aaa43e44382a7a6d246bc98c78a7bdb4c5e2
-
Filesize
535KB
MD50edeb86fc144aa08e53138d49b79d0e0
SHA1dc011aecca0acd2871a51246b1f7c9e6332824b4
SHA256e20950fa9d5779525113a6e5d4c8a644a0f8cc6be0a7f152fd7df3e24c890f01
SHA5129cba33bb73746d7360ad2775976c542fb6f69c81778675fdc3d571a3ff6cab804fab00cca30382042eb39ac96b4ff7705740fc7e7c3dfa71b954062afc3e9ee3
-
Filesize
535KB
MD55652779b56cc2269daf123ab3f59f2a4
SHA14db575f6013b0bbadb3573d2cf6e892c3ad8bbbf
SHA256fa4a6e9f5c34fd825f0de73b646fab0a89bfeba5045ccf99efe128171456cff2
SHA5127391424f7921a3d4f462610b8dfaab72d51546338a0b32e927f4a24c883a92d971513257e47f5181a72e217193f30840c1d8dbfe4a5c83cc20a3871ccdef4ae2
-
Filesize
535KB
MD52c90f42b09e052a0198805bd81f46759
SHA19c7873acce6a01892f200b4f2de3e9c754b7a1c0
SHA2562b239afae219f761ae2dd191ce01f4b475091ece4746b5b4367e2a2f99fa5435
SHA512cb24185872f8aaa281f34c8d6a5f2eb35db30ffffe9c1a2760a57603619a39423667de74bbdf27a60852ac975d5027b6937a7145b12589d77d69a561b8a94545
-
Filesize
535KB
MD5a11f365e1a8d297f376c1124e8f61b3d
SHA17aedc9accc81f7c517f8a1216f9a87acbe62d2ad
SHA25613a4a9a2716db67afb807afd63449e9a3f93a336e1ea099416639c583b666150
SHA512fa44810ea7080124528c49b37b6646c133b13f89517bdeb315b0037d719c3439d1e7959f139f6bc1906cae8943e26eb0a91513015a8ad9687b09531de016a512
-
Filesize
535KB
MD5160e0f596cf71b04879b62ef15e732cc
SHA1f4ba062f72d869ba31495d1cfc517cdf00fddde1
SHA256cc76ae3567312ff794350804dee674324e85d69a08a751cf9369a982c7d7c9dc
SHA512c99e77998880ffff11dbbf0426de48d395250db666a12430fdf3d92dd0f8667f99280d42f9b59169abc04b1112337aefd05e3ca2859f83fdde5862ea5dbfeda0
-
Filesize
535KB
MD5605b7525cc4ce173ea4a1575860e7487
SHA107d243a73fea7a93f2d43890dbb7116f2467204d
SHA256024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8
SHA512ee6cd529d27adab0d5724108cf40e69be08d717821a11432371f3665847e4a4a12f0c6ebde8712ced643a0339a34050630ec097c62f7f0193a470ce488da6cef