Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
04-01-2025 02:01
General
-
Target
004fec424e843ff98113f97bde2d6717f99975a2504ab3efa42c12474a62d828.elf
-
Size
535KB
-
MD5
22cd21f5cfc3ea409f3a05585d903949
-
SHA1
d48c82b3ce4460930518a924a51bab5c496b38b0
-
SHA256
004fec424e843ff98113f97bde2d6717f99975a2504ab3efa42c12474a62d828
-
SHA512
3be30393b65e4c1279ea8f3e076c6538701eb178148a0d546a391ab9d0741c99deb707a1bc051fb5eec26b25877499a0069950dc8eb1302f598492ea070e1bf9
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36Eojh:/fUywKQ7Fb1pNL/p52fjQn36Euh
Malware Config
Extracted
xorddos
http://aa.hostasa.org/config.rar
ppp.gggatat456.com:1522
ppp.xxxatat456.com:1522
www1.gggatat456.com:1522
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/004fec424e843ff98113f97bde2d6717f99975a2504ab3efa42c12474a62d828.elf/tmp/004fec424e843ff98113f97bde2d6717f99975a2504ab3efa42c12474a62d828.elf1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
605B
MD50473d6b916e38b62b464adb2b9d75b32
SHA1ccb9990dc230d0832652a104d1fb9ba306bb5b5c
SHA256fb3c522b63f85f36179c0bead351a15dfbca8dd6c49f1b528a134a1abb507920
SHA512f5c04856881bb508b9f5bee240c86ca065743b3d580eb0ce27d5fd9332d49b5a4e2e39ec869a613d583bfd4e0406e25df61ec8162c72ab3b2e72a2fb522df8f6
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD51e7d1cfcdb17f5578558cd682305d219
SHA159f1ee891a26c55e6c86ec6c9d36c2ec1537b52f
SHA256ced97c500d47c5385f36ae477c5f0757c14194353ea4bf410bf3012bd6b45e11
SHA512b5fd8bab3c1bd0cb5803812802167d5f9cfee193675abafb7067af3ab92945a90db6e0cd8d02adc806bb36120782f899fd2c838a45ac92ed8ee27be1f074a217
-
Filesize
535KB
MD5f2e1f9e78ee2737c3a2c08c2bf637696
SHA1c3fab1d47be93bb80db7dd79af1a45c273e8db71
SHA2565b04557d5acd98c8570cf728f4c5b4d1f199bf61edc1c7ec42a368f35fbef506
SHA51297d81f084be65e6fc3810503339fac8a635c63a29e3016ad96011934ec37a6742ad49f55bcadf390023b75b4f54a4f9e862a53bc490bbe4a0f77e656f9414c28
-
Filesize
535KB
MD509274cca51db3728c21307edae88b0f3
SHA1fd07b933ee2c1eb2798e5e5cb74b97098453937b
SHA25655fec6c08885463e799a57c736856ab58ba9b3e664eef0637dd836be7394beec
SHA51256bdc31246cd47f1c912e6cab01ef2d6a94e417f7cd0092c436cc7a5783f9ddb4311346d6fbe8de99db3cd12aa20be68c988c1d03a97a5299358f47677426307
-
Filesize
535KB
MD5aaa1aae13a492757eefc9426a8409209
SHA1e402e31a71ab838027eaf7aa420a60a5d2cad5ae
SHA256da2647bb858dd922c6908ef69b28638b2cb83d9e0dec62f6193b2fdd1a0986fb
SHA512369f1f343510e44dd3e3a33c6a98ddc5cc47fea2a2a760146e61aed4a3aa63dc0d48c6b912f40f7457a0b6778b26c5468896e12eec996f4d16d1b26eca3c51e1
-
Filesize
535KB
MD50e3a34899aaffc8415ef879a60a6995c
SHA110e64dc1dbf0aebef70339027051a4ca6ed1466a
SHA25669d6df0a50b207db6e8fa85e365cca01a02d07d0f24b9fadb58aadfe64320e68
SHA512ae278bdf48b73a7b450c4671e7d9eab865b3f809e59882820fe82c85a5957b5ad93d827bc6f56f36cda56618a65c8b267af43c2150d9b3210dad8e7ecc7e71ce
-
Filesize
535KB
MD5a26d90ca6a29fe0211ccddeb83d3c53b
SHA18152611e30a354340aeec3dbcdb0b0e812007c06
SHA2567b85763a29eafdbbbb8c60775b6562e7812524e12b5d586d254a33b95a056da6
SHA5125df0e1737832022ac64c8f73f24e863be5cc110593d500328e7e32991b947b24acbc1d68259b756e2c456ec78df16576d9dac3773031c0f410ea458887204259
-
Filesize
535KB
MD5203961e27869be3ef1a1c0eda07d9fb9
SHA15e65d5c57d2b165894a7bfbcab924fa6ae5b5d0d
SHA256740d6472c5d4a058aaebbbbbde2d84923a95e68083502f2847f2710675ce7c24
SHA512c750e4cfc10130a6ffdc28d032c011b224c249ddf2ca1d125301747b97656bf5219332b9f2c6eeb671920140797f589fce15421a66b43b3f8fb57c75fd101416
-
Filesize
535KB
MD5a09004fc7152d749294f5e5b8498c870
SHA19583eaca27c6e5f904f488da715002b2532282f3
SHA25618b488b8ca15dbb97abe6f08af036e11f9d55d4c1cdd76181931734453eda440
SHA512220f32750c1a591db4a5f8f2b1a96ec454ca0678f9581612928ee0ec133915b02b3772e9306e7f7b61fd3843581d242e9a8125939ab1e19277ed2d1e002c23ae
-
Filesize
535KB
MD5b8fdf0dde00c54aa66be1b11dbccc6d4
SHA1e012bf72e6effa39dc2b510bf4cd6f0ed2af1d07
SHA2568dbbc26ddbad29fef02da9bd325f90ab107802504f7794c988fe2d2a88e3b971
SHA512b2fa73ef34c027533926fd82dca86a3a0cf802648aef78ba450f5f61c203599dce65eafe7919ac6d1a401b459368e6c36066dca7c41d67d4e2ee08b81f40017c
-
Filesize
535KB
MD5763fb83a22570566a55d86433f154d8e
SHA1d392bcf14310b45f7f7b3520027d76c2bbd3a8b6
SHA256c32758b30fb86bfa7e161a21d161418d37c7c05c052d3884c06aa75cb4688ed0
SHA5125ef9835610c751288b74eb0f315fec33747ff5e536a30658933aa7b42f3e7d9eb19f76ecb275a7b3992e1c02d700139549f9acc0e270e57cf5d0a1a382edcf07
-
Filesize
535KB
MD58c451e13c0ada16eb0895579c0d701f0
SHA19e2cbe680768789bac4afc905e61f0e59ec2bb32
SHA256a3eee1232e65e15ab9567dc9bf14accc3c79884606109f77a2165588e6d52fa2
SHA512da27d20d71a603796abbdcc0d5b1c5d7c19f45a239faf51ea2fe00f37ce14273c375132222665586020eefcb9804a9d51c077155ed9b74e802c184b17a2275b1
-
Filesize
535KB
MD5414be382ec6bc41b943636899fe2dde4
SHA157d3be295107ae53d469c5a9768cdb0d47bdcaac
SHA2564b30807297aa983089248d62b3f4d14a921f1567f47b20fee11bccef96c195bc
SHA512d0e856962151d19576c380bc8d0f487cd409c179b903c4dbeb181a1547b2c0712d71d9ff3edffa9a49eb6aa063394947d08a50f5c3df23a5b9890de5f7d04581
-
Filesize
535KB
MD50a41effa56e2ff7cd8d7e1a30d6146b5
SHA1dd973396823e4bd9bd27861db4961601476284d4
SHA2566d2f07aa818c493b4b4cf3e8e9bb4dff6cbb53a47f521d3d72816c545099802c
SHA512cd2d062579ef248fca36c6793e70ad8b3afb055af9b63abbbb381d82429e9b34d44884bc77daf9cf6924765bd35bf0f63c1d5417746aea2675c97bc1cce08f50
-
Filesize
535KB
MD568069507c9333ad834c296bffb62f694
SHA110d70933cf4f1dfecfa1843f767a15f775a8f37b
SHA25694483e07fc43b037e5a3b546807910714d3134dfeac5f83024cda05b2f2ba7c2
SHA51237312935e72825693d0e52aa43a2f2ddfba75237790d3efad018e5892098cbefaac063bfaec038465f51510ce7d77f03b1ab79da23adc0fe57e6675f1b4e81f0
-
Filesize
535KB
MD588a1c0fe75b3233d8d00494b503cc41c
SHA18824a1087908e8573472305697001e356df75294
SHA256c37b650f2af7d595788852ab0714746d77fd73ee5c662ad081277ae6f170d0d8
SHA512039e55344a7519b284bc5be3b8778235276463b18b3a546d60321ad7d712bfb83bffe4b844568c8ca799325d1411136a2403c1b6b3f4b00ebe71fa828f7a3473
-
Filesize
535KB
MD5692b7f8ec3ed7743365565e927177ecf
SHA19f66cb3b0f348c34463dee7f895ac047c925ed0a
SHA25625a4448489c9603bc3f24dbe91d2fb2fd6258e8fc8043a844614fe1ad80b0c9e
SHA5125c24895f9fb611adf9711d243d5827d28dd0a755d72794f991660525ee5d9bf5e3c10d8cb490b49cd288fbc2d433618157df05459cdfec80fd376b2c4af307e7
-
Filesize
535KB
MD50733c482497867a01cf977a13950e94c
SHA18b8409a5c4a4b9855a96b244c4e153a981fd648e
SHA25619bb46fd5f8bcf42b4bd53ce212e2ba28d074fcd458ea50ca5b4d329b9b3f68a
SHA512a4cd9ad5650b3ec6ff5f0d696eb49556d1960c06b39ec1c4e55f826899dbe316de66fc4fdc6fc6ca4b7cc342a392c268cf1360f5964199158a1722d17d2b1944
-
Filesize
535KB
MD5c603cee6d0b84f779ce8117c2bf9559d
SHA1ffcaddfe5e22b474bfee451c120c47d2033c2030
SHA2560c87f4a095c0a57718ab2e5ef4c454f6d6d710575ce9c32b3eee19af6a93d68e
SHA5128f877da081231ee5fc9c0664c1ad2ffebdfc864096018758ac2eaa6eb1c8c5506eb402808feb6590170790da08bd4df75a52ac56b61d0ae785eefd4218f10a6b
-
Filesize
535KB
MD5f1e2714ca5faded81ac2c30111195cfc
SHA163dcbcb2f6d4f1fa87eea80d0fb2dfa30425f7c7
SHA256066e36d73928b372616a543d343471235653f64f79c8d6ef5aee7ddc9794b649
SHA512208e86cf2ef9090dbd96b200d3b40ffce08fc3af6bbe07a57fc68e43db82b0a055fd677465006507a0a933c34dd2a7ff6035445709202c28c9af03f30f0b3243
-
Filesize
535KB
MD55dd500461b0d17618996ce4ff3b56339
SHA1c08f44d42de5cf41b7a917acc88e5f841a18e25f
SHA25628dddaee5b75580fb313bf9c5216b6c6ccac52767bfad061256b0d99162ae958
SHA512e6bfe186ec235488d76a87bdff3da9853b51222143d767b8fdf7a9cbee02185e74ff4401a593e44598414be6d5a4179f837ebc57ec1495becf2aed2b8bd1077a
-
Filesize
535KB
MD5ea9e871842dea872035b5ba700cfd14d
SHA1419bf89aaf303700edb9d85ddd45743627b07e13
SHA256839c3e084c6ba5ab8ee64ee86d6b41135dc1f3a9b5154d0581b45cfd438e86f4
SHA5124253afe8303877a1410e6fe9e380378ffd3bc4bd6ee3e0773db5d18193861429b3e1d1ee2716e744f5e0ffda514c7c842815df7bc747c0ff910518d67d70ebba
-
Filesize
535KB
MD53de4c679c528643aa83b85be5ef743e7
SHA1ac89b374f9792dd52766c9b1ef0101d7dd377d56
SHA25607620b8d674e8c6c42b3e2c55e5a54e389febf6775eee674ea205e1c192c1ae2
SHA512a0d4f29b7d74c9b94e2a4efc94661febd3417125eccf679530d79281ff01799034fe80761214cc4305bcbe8377ae26aac055eb69b80a5291a0b8ec5fbce49848
-
Filesize
535KB
MD55893598cbd2b99fe009050f580f1b0db
SHA1faa80e3c911fdc5c81a251b5f18887af364c4e4a
SHA256e4a2cf9835047a7bb7e393cbfac7c9e0b43c5317d3bb65e00fc3470e50b2d854
SHA512df3c97ad675f2fb0598f5e2d7d2a24bc991d4d8bbf551f64ee63233e5471f0c23a7eed54f2e57e186952cd3fad04e878659bc755d278b77530f52703384de55e
-
Filesize
535KB
MD5483d63a2c3204f79329bd316c2e76743
SHA15beabd613242819704e22bc07459d93d7ded8180
SHA2563c9341b95c085b5cbb4b2888f9285fe3202b36d7c3852812dd6855d316211cb6
SHA5128e51ba655902c4adb3ba60fe09fe7deb863ebd909edf349998217dd76edfd41b7fdd1195c6154a62bdd4d7987e8ad53f459b0d6065c6a160b383f350c18a9e38
-
Filesize
535KB
MD51c7c2ec60ff28ffc7316a9246f377d9e
SHA1c7294e118ea25a2a385fa49c7a25c10bea13dd11
SHA256de2b4d391f99f0283b7ee32b65d4b091c9ad42a2fd0c6296143b36a7a41699e1
SHA5128f3db1c603349329ab244047913ef260071ce44ffed03fe827e91864610a8668c90ee20e6e9dca4567fd4e130143133f06754176fd7af583ad8ac338e1e6ddf8
-
Filesize
535KB
MD53a64c6f06904929f6e36cda41b589e8a
SHA18d190d97bba9e3ab39877d85757e8f59f7b7c80e
SHA2564b92fcb083ce888da4992bcb8a9ea2288d30d2ad1dca6a694f6fef891af8262f
SHA51261641d3693c9d41c84ceea8e756c34434716aa707077f052ce6ec10c1037f3fb915fdf7a024af37f4a176ed1bd539722c982bf0c8ec00237cb230562257f6a29
-
Filesize
535KB
MD5f7149da0c3bb33c62cdc59e0fa389785
SHA1e2ca99437eac9c962066ba52c14503f5333c48d6
SHA25618c6f5a856e7d6132aad34fbb1aa9505116d61e4f35d6f80e4bd1663d82628d0
SHA512893a8b86fcfdc1bda5251216b75a80a6f1377fb05287de8fddd70f58a842d4db037b462a4e02f64d23385af3e1e3b75beb12e5d8c86ba636eb5057c7d3228b40
-
Filesize
535KB
MD53bcde6084340764f9f3c37d0cae214b9
SHA1610a9e8448f39cae4b0737bd18473f77930605fe
SHA25618caa8c3eebbf1b7c4d530dbb5a0c270955dca7057e130f7ac005a848748724e
SHA512e4d7144401737bc65b3bd99e76ae4d8408926f3db6e41a81d39810a10a8ba33a7bd620446ec22eae7acdd8661f3b85f1dfaf0390117d952983a662a19b3bb92d
-
Filesize
535KB
MD5b77a5c4e7bd58c9acc3c087d1ba77019
SHA155e164c569ec3ccc0f7984967fca347df2308c81
SHA256ba1d6678adf6f711318edf3f57f746e4a2195e7dc179f8ca36ef603444dbf252
SHA5125b697f665324b44c07205e54cfae30070f4c433c1ba9bff91cf79399358240152090c36da5729565af57f60d595e92bc5431f26a96e7e566b5a51a560571f4d8
-
Filesize
535KB
MD5d6cf3d277151b31be03f734350f31a62
SHA127041075f73769ba52865388665be644f063720e
SHA2563b0f1238a0a12cad84babbe7bb61bb4b44fa2d75511b6d050a03e01fcd6de3d7
SHA51290748fa3ee8538878aa1adafcd70e59f13af1ca815a8cfb79d3479c53b67f008da8e7ff3a0c99fa2ee5c2c1d23e62d81f621f73a1d50e60c87cfe36a3c198917
-
Filesize
535KB
MD582eda80cc3669e71a279cefaabc5a3ae
SHA10aba6bd3255b90200168e1f0d950d2792508a447
SHA25603fcdef20b13e4a150e33f77dbcececa53122884b6a175b49abb112664dab878
SHA5120d6f53f9fed3d23f8f0cdf51e80183c5651b5b732a419ce537caa17373f3d83ed9aba898ee9085774e6d660f8c32ff3f7dc3a8f354b41ab8dd381ac5ba68771c
-
Filesize
535KB
MD522cd21f5cfc3ea409f3a05585d903949
SHA1d48c82b3ce4460930518a924a51bab5c496b38b0
SHA256004fec424e843ff98113f97bde2d6717f99975a2504ab3efa42c12474a62d828
SHA5123be30393b65e4c1279ea8f3e076c6538701eb178148a0d546a391ab9d0741c99deb707a1bc051fb5eec26b25877499a0069950dc8eb1302f598492ea070e1bf9