Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
03-01-2025 14:30
General
-
Target
309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf
-
Size
535KB
-
MD5
b942a12b9260eff39da67a89c096ed34
-
SHA1
9e85eda9b6bdf0232f4934924e81b90e15a55a30
-
SHA256
309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55
-
SHA512
a983ecac632d2693403ebe77f19c86a1ee5ae90d1f37e1d685a607c9b939f3d6b7c12507a2eb8f48e5e5cd8bf4aeee601fee9357c226f11fb35b491034677e59
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36Eoj9:/fUywKQ7Fb1pNL/p52fjQn36Eu9
Malware Config
Extracted
xorddos
http://aa.hostasa.org/config.rar
ppp.gggatat456.com:1522
ppp.xxxatat456.com:1522
www1.gggatat456.com:1522
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf/tmp/309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55.elf1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
605B
MD520358bb17e71b1949ac27137ccc943d8
SHA1c5ea1324408dccb98a25349872d23821b927aa63
SHA256081dd1e0d9d63884c269929d877648ca54bfeda259e57a5b3c44e9507ae688da
SHA512564d86cbec161b8849808aa70b10037658c88b509f10b7c9b45b986a5e452d5d75ce8cc04ebaf1ab8ae867d356219ba343e8d71bb193f30ebbeef2240e3e0b9d
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD5ae86da934382a9d422cb852d65d4b851
SHA180740c56fd1d920c5294b150824b50ccb53fc7b9
SHA25605ebbaa3145154540e56d4ddee9003844f77c18af56bb2cf922853541135140b
SHA512e5795866cbccddd85151a44c93a231e7a24f205ea024a26510fb815e190236f019359e467f0fa49c25a26a7d066993b689dea41283a5168a08ab5f9f0c8cf4db
-
Filesize
535KB
MD5f37b10e83b388a440272d66e2e1de313
SHA10ce565b7532d7d230f5ed8953cd5cf9b87b1dc7b
SHA25655e11591b57da45b6a323ee83699503c58975acbfeae9576d50376b67cd45d90
SHA512d0c059c49b83208b714b87d93b7c9939f154566e463afbeedb6de80c7205f05edfb14913134dd03a55a915173063ab4007cc1791328cd967f1977cbf75e1c40c
-
Filesize
535KB
MD521a0bed4bed956bcf555dfaf9dcf4057
SHA1c9b1c860ab656fb786c82b636d18d22fb85e513f
SHA256baf50ac3364f2774a065de148ae0459965c7c3d91c9cd5eb59da10070d8b3fff
SHA512f6d15e354a6661861edfe72c28f312cc15cbc99622dcf247966fda833b3ffe4d9f69fc8f766157c224dbb6dda99abb4e7b8ecf6b1f61d8b83064e87b6a4ca39d
-
Filesize
535KB
MD56004da348929b8814d0559f4f10cc0cc
SHA15b0466b01e5d1b24f088c7b89f3f112d1e828d9e
SHA2569f48a989c7acda58545b4d70d75f94f279b48ce82ea9e338ce6266b5fcd2ec8a
SHA5123d5bc04d577d44110278e02309a3a9c540ec6f11e7d5925a55213a3fe5f6b01c2a26e082c969563ee6d8fc92f586c39f5dec59039768f335fea9c6a25e6c81b5
-
Filesize
535KB
MD53251e9855ccc92c6e6dec413c1ff1a50
SHA1069b010fa4c10b28e1375f529a0f47e2a6d05dd4
SHA256d2797a7fa5718fe9215b050a2a6bcd8f54902e2a7a4a611fe20cd48ecff525c1
SHA5129ba9a083b004bdad0a73300011912d69dc82d155044ffac26c4cc0d9544b8b9a2599ae8ee64af58e3c1ea1bb388feab288978657bcb69cf5b83e939dfff88eb7
-
Filesize
535KB
MD5984607958f594ed82c7669e55ec78491
SHA16c4dd51087945c167c4b55a332f57b3cbd8bc145
SHA256b9104768a582c2f64a6d3dd5b17ad47c0e55b6f2c66e4a68bff6987efe7dd1d1
SHA512a572cee475a03b2ce41619a529633a0db6301ae0fa0af5d8361c81332e5db2e1367c1ff9074561e3d0f2d9fd5c4501645bfd8471e6e68789861beef521f93369
-
Filesize
535KB
MD5f152b419137d1bc7b08c4a72a1d3c1ac
SHA15b2cbd4f620ad31103e434ee5ec9986a5050741b
SHA256e8b265af055612d007efa6941ee97b57080507e8dd79fc5b95ae4c107bda173f
SHA512f2f1bbcc4dcf60f52f1a869202c6b9dc2a2cb4296ed679a384116455e42f3e60e3bbdd0a2d9dba8f4a765b49d788a07f5000eb6b2d34b0270e047870b5624480
-
Filesize
535KB
MD5480dabb54ee867e38e628fd09f492e6b
SHA1222aff9823230eaf85089061cd48395e4dfaef84
SHA25602e3154c84019f5bd33330a934806aa7240935829c760ab4a1ea5fc6b0704cae
SHA5129ec9b9de375afd2cd5e87277cc3dbb54913a3e0992daa2c63edf8c8243ec5debf0408436cd5445633fbd58dcf8da35aa6c493c5d32bb11ea8ef8a3bade0b7f38
-
Filesize
535KB
MD50f09f849d01e1cccc606164361851a13
SHA141e27c7446bd939a67889cc55811a3305d773751
SHA256aa2b09a66c8ad4499eec236061cc7b387356aadf583114c0e415bf5143c6b0e5
SHA51287ad71424a2b875b5b78ca00aa4055cc7e8a26d478ed3cb626be731181e0ad801c9f221b1ab25d6bd285a432bb95fdeea92a4f9e89ba165c6438d5da53004e0e
-
Filesize
535KB
MD5871a8c0ed5a9447e0ef1cdef015fc8aa
SHA16286fe52c3b7f15f069ec4ce7f8ae5f4e9e30680
SHA25688e09e6fd9d940f47651f50021a0e8bde521ff246fab738f1ea573f1fd5f72cb
SHA512ad5d59c36a63aa8b35693790f6a6c120bef588b5cda69e73bbccb723c58c8c7a00bce3ea570033ee88fd7a744c0f72614985279e79d64cbe571efe266c0fea5e
-
Filesize
535KB
MD58e73c3bb1126b3b8fc18a79f4cccc2ea
SHA135a9e024c0181e45402a0e1aee5fef0cf3893a1f
SHA25677ddc8838246f66b19bf7014a5794452cd057f78ef1391bc523e371e2328c1e7
SHA5125c471c142949e43d1d3eeac4d54208203314825131d32850e68adbb553e0a6f2fbf07c0f37fd9959ff8ec26b6ccfc4d576f67a0449388d48a53b7e87f2fe7993
-
Filesize
535KB
MD565e41fb8dee5166b98f7cc72c0725833
SHA187b347819a89e34145577b53bd23bb26fc79df6d
SHA2568ffaa8fed1d556a47b4becd450f48f0d2d84b26305ad1539a1c0edb444a7f15f
SHA512b2ce485d163ca7d4667161d99a8b1268126591f91d377d73ae937627efd1615f84f5c711185733cbef4d4c97e1037eef9ff593ea9d26af4e6e4b2b25592ba408
-
Filesize
535KB
MD5d2c8dd6b2e9c0d20590a1cdf352c5204
SHA1528bbd921c54a2892437160bb0de29646e432f7a
SHA256af45fc41853440926487799c0197da67c0a08632558f827bdd21d409732f57ba
SHA51285551959f0f2e4e8910443b148d4d8da1b6bbedd7ba7c2077db20e35cd1b8bdd1dd24d3ec5a4a63e5d748b14609a28a7f205adf18f444a26094b7af489301cad
-
Filesize
535KB
MD58f1f97492a074deeceb4041e6e6ef4a5
SHA146cdec10493fba441750a2afdbf7441b58ed8088
SHA256d3c3d39038bc5bd70873075e9f4019ec0f758ce5219706780936acd41e9023b9
SHA512ba4ec632b6a9ddbb9f7667e2a2b992bddeb03a38933e167bbade097a5965385e39f8c629bbf3cc0881e0dc312e8a9f9194b03729df5d3ca37ad0e756d0403ca7
-
Filesize
535KB
MD514d2b74f4dbbd953866565595aa6e846
SHA124c36902b4d992f96233061ba9b8df2845bbbae4
SHA256d787d457380353580762c517beac79499518e446386a18c428a2bdb28f2845cd
SHA512f5cc558ab49161c8c80be7c9e5bf0bd7693fc21c37a2c47bdd90073656fcddfb53fbd12d41c2ddc006b95dd41be33e669cfe5f009282dfa614a25f57e480cabe
-
Filesize
535KB
MD53ffa18763056d48a3033282a27611caa
SHA1648ee0f0afc8f14713eef9e45ad6778d61bc20b4
SHA256e936c4305023072ad12f45a25a1383376bcd8d96a7989730af218c800ef4ead8
SHA512d6b46f908cecd0ae52eb482436a74993ff7ef8f1e09e7bc676820c30cc84a6ff3130431deab6f8d33648d884df9626bf9062e615f85e87de1159f56fc9375b16
-
Filesize
535KB
MD5cf6328ddf80d47f738b5ab65bfbb2363
SHA1a6e8282b872114293b47077a49f742ae25454e2f
SHA256cb8e253febd670df3ad4ef88242a6c05f5a7fa318d4d79e9a2f546bf81202b17
SHA51237ff77bb365188438c2a53e306b424f7861a81ccace72054efcb4359d6c2d7b3eb80080db6a591ba82771b20dd14f6f8e664c5ffddeabfcdf07c37452178ca62
-
Filesize
535KB
MD5d14f21987bbaeb7422a5f2507de049ba
SHA12c0421dbd18a8eaf915eff888b4f0c526ad53ce0
SHA256bb901f1d43b96d5626f401c2df3b2b9bf0f67cc1db08c596bda111bac2d0e91b
SHA512e77f5d9a1d7bd5f74301e7b91e48f74641a44be988e397ad07d88d9480574b7dda4ad61d5125a500d3e9cdc2ebd732fbb3eb0fec681432cb962006eacc2cb8f2
-
Filesize
535KB
MD52b5bf56c5fbd9327af444f1287bb69a4
SHA1155a397f4b9c30d8029a64b26d228c155c86a508
SHA2565e21e4a6bd92a41bffb903323d3a529c5b91102efd868a9e6c73ef3fb8335b36
SHA512a93473884a1d8e8f9ce5a30064ceea6aad92eaee77420df6ea229f24c84c1a7eec529558f7f480926a065e700d8c692555ffc01bbd75470dfa6e643696628c63
-
Filesize
535KB
MD56670b34908495a8d71d67ce4c418fb25
SHA187ab44f58e881bbc6f0835b8f687ff8e85adcf13
SHA25639ce8be21e3c682d3f8f7d9a440977e09b30c3770b7103e93d98e1b5eb13c8e4
SHA512bd9e4d9cdb8d0d3131db16d48e2a72a4c0b4425c55a3d84f16b6f6a1f39caa5a0d757c6b59bd0b01fc9a0f0688fa0e18c512b7fefdbaf461861b755afd0fd3f4
-
Filesize
535KB
MD59ed1b47bd277c0a41bc3296e2cea722d
SHA1d38c9fec17c9da5c5fc3f010a68c82916bbffdfe
SHA256e20315d06866adbe9f7056c7e09d70bc7037fea228da6985e87127b7adb8a0de
SHA512b5cee670e0ec5160b9487f12a0bca88aec5af0ccc2e48ea29a403df0c13d1d70b86b93b7e8a67e259169220a6704f6ca50d780d7892d9a9384880393d310107c
-
Filesize
535KB
MD537d5a1341127c158f41d54587a5cd380
SHA1c6cb190ea0b86e3852d38283a162723b4be2175c
SHA2563e8bd3b5c1f4cf5d1724ee386bf513d74a52795badb5ad3c4e6639a14525dd42
SHA51216d0dd8fa1cf7432f8050046d08672dd6b33d403d8e60e8c069711b4b899a4ba5a49f659ffc9fefc5881985bfa09f8ab1edf0e4a99b3da5aa07351fe2973bf75
-
Filesize
535KB
MD5c4e6a048fc2e2ec1027ec8e6c17a74b6
SHA13a4f740a3c7314ce174e3091550d3a3a12707170
SHA25683a23a8647713b0d8c98cf9c6ae37dcb3c9c6fa0a115041cea73b6b48d09de74
SHA512edc923adb749e017c1e0529837b08cc974752acb4c70fd105e9af1c6ba17b9e2f879a12e8975be5602efae757bf76175dc97553cd055bc41f78420df91b4d6fb
-
Filesize
535KB
MD5cf792f543c60d2ed22da7979a5e46b66
SHA100c07f9e49596e2f1bc23098a7cdb1279bcfbc23
SHA2563730f4b4c33a98a298ebf652ed6b7d790abdc484c80573476b821e31918d0ebc
SHA512a41e9c3c7560cd1182d7e64421f770e9e70aedc1fb56ca6e176abf62bd0629a21e63fe1a3ca85d44d8ced8e52ea99d63d06534140741317515f817ae63781d9c
-
Filesize
535KB
MD5957fc818956c44479e2be13c6ff5a15b
SHA102ff38ee63962459fcb65cb1cc364df99316c65d
SHA2563466d34df35687b24e7c200908a136b89aa01ea9b81f16d53c8e8f1f296aed0f
SHA512530b2ffb4895c4e9d98d893a805876c348227d2f8e583178eb68908c4b66df89d66c80bbb646729363aa7a5b8470e85290ac0af507c78f98abbfed1bc2e55237
-
Filesize
535KB
MD58416468df4a5e095047d932f49392dfd
SHA13ed96fa745db89bc38cee2726be2934089074d13
SHA256311bab1732c2536e66666f0428ccf3824c0a83db04bc3d1ca168cbccca5be813
SHA512ece6d3f1bb2b20d3588215f5e39c9c7375f086bee2582d230aa3df0cc42ef3dbd9515a574041d404eaaacc8ef9eb745950630d1403b867e870fa5bd34e1a6487
-
Filesize
535KB
MD503ee95c81889b956f19289071f2c7b3c
SHA110036e59a652a02321e0400d3de818fe0233df85
SHA2563032f67b62b819bdca1a454a2f1b7294a6309373f400072603075bf377161359
SHA5121cc81dde11f57917bbde16163ea33358ae687003c1927b92448866c6e162dfd5948c429a8569052a35f7359fb093baea455d45f1e70538fe6adcc61c5cdbe085
-
Filesize
535KB
MD578a448db2f01182cd9ddd2d85cd6e64f
SHA1e32518e2d18ae5d5dcce4d72e12f5244f15a1926
SHA256e5aa07b19fe0a875cb6087e49bf6fe51717695f8cb057b1a1a5d85f3aa8dfd2c
SHA51222639facc0ee6b38de4198cd4e631d61c0d305991d689abf63a745adef799a9f8cccd978ee1bf056b4a0783442583806b8f78d1c5776fe03bcfbe612edc60ebf
-
Filesize
535KB
MD5bd8ff6236e96b4fc4fe21ab27f675fa2
SHA11d254b47aad2ce27f4f766de55eea39a14cac096
SHA256d02e9858c224269e02d2d85258432ee4366309e45cb94af625f4d61d9191665a
SHA512c7ac02d76c45893736c3c260362d4d594dee6ba47a3ef6dc86a2fb40f88a10684edc7f562887cf40841f9cf7f84b7a810d30dcf31e0522a59c2389e77aee9141
-
Filesize
535KB
MD535da72cf4ee1e65eecc5822a67bb300f
SHA19d4675a5411ad93c95d249b7ec777adc05c324e5
SHA256ac1a57f490689c3aa65666a5d8636a2de6432e74af95f3b00187d22b71c66fe1
SHA512020a364cc69c14b658c93826eac3ec3e1c6c0af7a584f725f708eda73e0f8ca1dc9e361a53b210efd8296f8b236cbf3482c643528e3ca501c99ddc27b9fdb5c9
-
Filesize
535KB
MD560c7b052d6a5fee1a4e4afffa9515a2a
SHA1b92848cd0ce974a410d825658a87754887cfb8c5
SHA256a54fd3fd5b8d8fbfbfe840cae68eba76293a774ec4f84546dcbb6f075430de69
SHA5125f64aa0826ef2562153e68c23f09c6def414f3026d2e569b8866d70fd924b05f67b902bed4e3dd2dad7351e05e6976632445b9f48606b391df7d4c902c3044d5
-
Filesize
535KB
MD5b942a12b9260eff39da67a89c096ed34
SHA19e85eda9b6bdf0232f4934924e81b90e15a55a30
SHA256309310036d4a92c12131cc0a0455005a0c9f7e73a102081c2e146e77640fbc55
SHA512a983ecac632d2693403ebe77f19c86a1ee5ae90d1f37e1d685a607c9b939f3d6b7c12507a2eb8f48e5e5cd8bf4aeee601fee9357c226f11fb35b491034677e59