Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
-
submitted
04/01/2025, 02:01
General
-
Target
024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8.elf
-
Size
535KB
-
MD5
605b7525cc4ce173ea4a1575860e7487
-
SHA1
07d243a73fea7a93f2d43890dbb7116f2467204d
-
SHA256
024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8
-
SHA512
ee6cd529d27adab0d5724108cf40e69be08d717821a11432371f3665847e4a4a12f0c6ebde8712ced643a0339a34050630ec097c62f7f0193a470ce488da6cef
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbz266ySjQn36Eojp:/fUywKQ7Fb1pNL/p52fjQn36Eup
Malware Config
Extracted
xorddos
http://aa.hostasa.org/config.rar
ppp.gggatat456.com:1522
ppp.xxxatat456.com:1522
www1.gggatat456.com:1522
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8.elf/tmp/024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8.elf1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
605B
MD515c712e6097c28d202879434d173154e
SHA1fb17d203a3ab980a439c4a633330ff14bb534dc1
SHA256452334256837c6ed567a89b93789f3bf8856195215abf4f97abd1dbd73ce1c55
SHA51280ec64450b12eb70a741eb6f39c60efa7e5824b262965a8e91a3c39108c7e73aa2cee2214859f98bfde69ed328b0a7e8a9dd6de884bafe7ad15e6407aea419d4
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD55597a8c952d187544cffa0c6321767e2
SHA10adc62dc13e7a039fe2a8324b08e23669f4f991f
SHA256f7f5787f8cfd3b2ddde33e9cffde749fd2764edb5d8f7e7e62e2d9cca80861bd
SHA512ae49bad4963712924cf75a5995cbd7d00bc0baf6d07c4910faf0ee7d118e03ae7ace2c639675e1342ea05052de4af11db39669b6b7a730d90a6fd5643093cb88
-
Filesize
535KB
MD510d5fa0a2b34f477fb621e633f2c5f47
SHA19119b0316948245e9bdd1cb7666706da842a610c
SHA256ec3b7a36fcb6e92bff23475490eb67acc171fbf03331a9702516555ea414a468
SHA5126fc1897fc2bd7c63df3a950a2731a9af656f91696d61a3b5a2ebe79afefbbb8ae5cb5f521c0bcee6401e1024cf3f9dd7c0c91eda742ab691c5ad67cd4c708991
-
Filesize
535KB
MD587b9d35844f01ea636d33e9cc634fe07
SHA1722772f7d9eb628da1317e7f753ab59fa2a02ae2
SHA25626e5420554a98c98b7686e3b4a1785570d6008ca41547daa4fe6b8b9c0fc12e0
SHA512c783ee9cc7e41a88cb63e3964dd25f3b25c32290716b0cdeb18f8b79f250532546f8fea809885b40b8df5769db4925e935f827ed29c2816a300c8eace11e2a12
-
Filesize
535KB
MD51742e5d1385df07bf479075c4d758289
SHA1fbecf2e7847230c0769c846614543b76cabd8dff
SHA2566031cbf9c8c51bf2663c8eef47326e4765e8690d4ec9e73025444dc6b68bcbbd
SHA512118e9d43264ea062acdb9f99661c98b87924ac1e0018f2ddd188aa2b60ae3ffa98d798c87a284c3a11ca2470b10ad8928873ec8445522fcfa5fd69e7335a78a6
-
Filesize
535KB
MD5a8a1703d5f34aa90a93b6f342af6902f
SHA146aa906f03ae9ddfa158354702a71802ef47e7eb
SHA25671397d5c5094b17e2f7166428fb5a174914c9c43e3c6293c804e762724d4d9c1
SHA512276715c2a20a6a0c8a8caabb55fe5cc809aa16243180d433476a9fa5785c80aa25573095b8a5a009efc9cd1554f784193b21becad14777a71db5a99f9a9a28f1
-
Filesize
535KB
MD589eaa5c4ed1e21a1e8b16436f5ef9f60
SHA1dc90897abca6cc5ca8a94fbf977423fd550bc3a6
SHA256e35de0e26beb122a5517b5451a00daea1da2bbd09ab08e1f1b98e1b466325702
SHA512d89181ae48bc78b3f038e71e7ff2ef30e6c65ea525668a7e429e471fda14bbc542aa2ae0a4577ea2ad4a13e2d1245d7dcd368b92a560a7415204abf4db280aab
-
Filesize
535KB
MD54b771f7a891cdb6bc9925627b9dcc58f
SHA1d1f69eaf4dc90f6841ec1be9ef356ff592592f84
SHA256e31fcb337dc928cd19890e9ccf33f9dd8630cdb9824003bfe1a5b4906e66dae0
SHA512b02ce982dc831cfc50c1dd7d3c3258e0c6ed6dfc4fa8913f2420e3fb38b5ab5575cd33ec7139f19559191fadbf4e08311e6ddcf03fd6aef764cd2c774aa3901a
-
Filesize
535KB
MD57f84ee6f64c99c89f2e8df66e91b3a25
SHA1d7c5f8bf1913847927a9fb648f86bfd2c0f7eb6d
SHA256ebd15b2a711a6408c244199a3f70ea914fb4367ac5fd6c1bdbc79fbe74e27281
SHA51282c8e1fd2a9070683582a8aa48519923c63c0208f9d8f0df5b703fbec8e26ca19f3605827d741806d42932304e864b3ceed17f41e08e6ff5f66b232791622975
-
Filesize
535KB
MD506c9a6e6650aaa5aa468200f50afd1a7
SHA14e0c9546e4690bfb12111f45899e50f7d326d015
SHA25656b48212c963c3c4067fb4851c25d4507ab004b78126a1ad919ed17ff739d168
SHA5123177fca4e43c6e90c89475ab4818c9f0b64a3a34091b342d73d6031692ba7bfb0b2680df576e2eee0f678872593023a370eaf50f7254c65315fba1de48df8a61
-
Filesize
535KB
MD515137fb5843186742c11f5c29a893b70
SHA1bb2cf171907dc00c0854ac2583ce8a7616946fce
SHA256e189de17bff43bdbb1fff89b43a5e81b4beb566fb8610598631dd95a2d74b0a2
SHA51232ad7d85b2d589c9ea1ccf98809cd684f157b93353af9a28536a2c5226467601e7f13a550c500ca1504b94cd5b49592162edde9af2f2a4bd0ddf7df77fd1ce72
-
Filesize
535KB
MD50be880fc0867da286e0f5ee0324eecb7
SHA193989f7cbf42ce8881327e894349a4a6b0978430
SHA2566952e31ac97ffb1f162e3d1f1b31a904736d248f63fc5da86a5c503302ac7285
SHA51272e5d5ce5f0a4322db4688e13e38d61c9633794968d734006d780fab31719a9892ae071f4b8741f0528a73804d009e2374c169192379bdced75ea720193bdd99
-
Filesize
535KB
MD534e55b5edba88b1411d256426b8f5446
SHA1a92dcfecfa75803ae74484b5657fd3ce599fd40c
SHA256b352a1704cd3b2c3eee0f3347f637dce8ae92499c84b95c55712fa3fe7918d23
SHA512e49d6f47dcbbebae77737766150481ba284ca059028220e7fa72dd3d9630754093f711026d506bd7632ffe802e39c263818251f977a9e91bf6dce2a4cc2dfa4c
-
Filesize
535KB
MD5a9d3030181986a142abc8dc74d0ccac7
SHA1088c64f2ebf902c6e898ce9e798c3cdddd364179
SHA25693fcf42a33f88affca55e114acf3a98cff7a14959b9be4d856134c5f05f9eef1
SHA5128f131a40c1802aadaba58c6a21a332a16b69c640b9fc4b5cfd434a0e6c67b7fecb7ab1087ed4b06aa7dcbbad3e099508a09f5180c4970fd9968cdb75ea7b0189
-
Filesize
535KB
MD5fbf482690ef9f172c13c393d3b35c238
SHA1572fd798a579e8f48eda136700aeaefda18443df
SHA2566244cf19b470aa2694b34ff7cb900ad7f81985e203ab40cda8ee8eb8105f6399
SHA512ee042cc6010ab2a12e936e0df40e01ba9999b39377fd1e4902997db76798734383d2a3168937eccc863e57cabb998d5326b54ef683dfe7a1d547ff13180bc30b
-
Filesize
535KB
MD5883fcfe29f4d77d2c0666f16a459c506
SHA11c59ce11c3783bb0616c18a8c2660b3f455ecc85
SHA25699382ad002bede31208940a3ccc7d70099416ebd20298b49c407e7b5bb4d6886
SHA512fee28117fc3c429f5f6d44955906555593e200e0e1140735d7a3848f68a03c3844dd6522878ed722104320bfd239573b1e7e92c5125f803db784e5ca2881a766
-
Filesize
535KB
MD549834c2cf7be5c8d9aee8bded5ac5124
SHA14d0dabe0ac5fb4fffe8ec3f46236768ed23b9bd2
SHA256b9d6501686ffe085fedc4f61f1f1e3c1703d11d974e3b7fdd320b6f47d941c9b
SHA51294f95fbcfdbf78fe7857c81549d5a6552c39e7ef7493976dd06ae7ab1303f143de37729bcc3b0d3f6ac27358ab6d9287479b75f12c0681e4f6ce53d26bda26f7
-
Filesize
535KB
MD587d03eb795a2819c8126d37053cbaf0b
SHA1e2d104d679c905469b77e1a60cd9f8ea6a178dee
SHA2562587c930fa57a2c1f96ea67652a8cbc9b560ce7199da430078d94a14e7152712
SHA512b5671567909f050591f0b6bafe437cc6c662fbfa0a55299551a3af14133d76869cc18dd767e82dbfc040bc295abece7e26198cc17c802e0a308e0239d6b5c190
-
Filesize
535KB
MD5a8504b87ab24f5c87e7d119b782d8d10
SHA167697598fc4b568d87443f6d8235961eee921fcd
SHA256a4e366a8d6f5a92d3f9093742b892e72e35384242d31a8b635e811238883ef06
SHA51234cc500217adad30d6100e6940608e599ddc62e860324708bc598b1e016f632515d531d420fe7f076f6fc5dbfa1a4fa5b51bd4e932c9f1b6b07aabfa55b89c07
-
Filesize
535KB
MD52dac1442cf697394b44265a60f6d261c
SHA1da3e2fec9de8d6137e26864d40132610849ab6f3
SHA2568e6b8f27188016df9bc0bbfb890f91293574c7e648570d11176de486feab6e80
SHA5120935dfc9c4db75d676b7cbf8527a5465e235a9a6624719f3d5e6e31e4af6347e6f2d594e84027576650116be1223f36729f38f73b7f1c578949c895c2834dc68
-
Filesize
535KB
MD5f7af953263eb2b5983fa1327270277c5
SHA133b10976054962b78bf3d2ba1cf269de9d3cddf8
SHA25666db9442b05ff7fe243503f875aa0c5db81c000bce2953bc0612ae5a80f6447e
SHA512a8906d5cc6a9b8e5f3f5a89b1b084aa431a98c1bef11702195174817906a092cdc8b56d629652fdd44634a51601493aa1e107f37bc0079dc226ea0cc552bd701
-
Filesize
535KB
MD52d177a1b94854bd7d8a990411a85cae8
SHA1cf667a72ce255241d90d3a9a326908b244b5816a
SHA25687ec0a63bdc97968c98b9cf5e459e76e899389c16de7a8f9d492eaac69c454a7
SHA512b518828daa25bc3292ca6717295e697618c13c8f9a83d2de0b4e4bee816565bc2de50b0863bbe3c6dd6fbbbdd85ee1c40ce7227dcfadd42113a7ae96fb409b61
-
Filesize
535KB
MD5c634da4413b8bed8f035f0c8cfc7883c
SHA1dad4312128436ab5b35df9a3af662e313b22b392
SHA256931a14efae1b36221f1aabd84463e25a6d8b1157e4df35532603cb6b07c98104
SHA512509e17c87497ee078425d958a04e218667fdf150716ac7f11a4cd9fc0a910d9c2107cabd18d6f76fa36d18f513c68f3aad47afd1e0f6c328480a4d7a906fe045
-
Filesize
535KB
MD553c1ec7e4019d4069e34c96416f08795
SHA1c9107973a031faa5be5f7576a4d69debcc8aecbb
SHA2565047d6907956c65f00c256555e028dda8ccb955abab655eb78ccc3e134dc8510
SHA512460ff59d9f5443139b64482d5a5da0871942ce9a03b6007e8a314eb2cd6375061ccbe060c7c7cd97d6384cfe992defe10da77caa22d06a1a1748b56d7458773e
-
Filesize
535KB
MD57c96192084080ba0cfa070378cb33833
SHA1ed6b037a9ffecdd82b363bf87b1a613d2201fd6a
SHA256aca117ba591d602d713220c6c8ea163981c04c224775f17e412b5a325b869744
SHA512e69a081bfa5d0d0ede23dce310e9628698efe8d214b776bddabda284cb17f6264e010d76de5c7ca66b01b339c0afbbcbc96ee0eed32d18377a564a3ab7a5a04f
-
Filesize
535KB
MD5bccde5a0ca5389cd97376083c292f711
SHA17da347bb6753223e59d6737beba74b08a95d5d53
SHA2561574ad4460fda898dee498f64f9b2339ade9b25061813dd8b3d2db07b1f69c8b
SHA512a771808a8a59074c45df79f45e08788b248adcdf441258d31d152d83a88cdd5fbe81f2efb9b94678ff63dc805209fc48cf86229cd53bfda79b951a51ba4c3fea
-
Filesize
535KB
MD544c8fe38dece27f373306886d415d3dc
SHA1d1f068c80b0716170f45d7a197f6155e2be9d813
SHA256a110e5dad5459c3f95576ab002a945f92e60245bc9ef4e7ae3f31e996260bebc
SHA5122d8458d1e7a410bded01d921bae567a625b25eeafd22d235aae04b84d1a060d03953ab02e01a206d8ffbf5ee3e99fd451613ae9be5e4778a538560f826845db5
-
Filesize
535KB
MD55cefbbacfd3ecbd99de719c3a10fa9c8
SHA1d16326cf5a1933cb8b3a2dca1d079c72404f6597
SHA256db7723c38f04d07c6e1848937396abf21816805e589ce5b14f834397757f7be9
SHA5124448d54e9cc12f43ec78396b353eb7414c1a3e5498f2145b5bda9965ac92a4ad2b37d6d7366568a3398b2a30b5af03eb6af3f823b24cd1cb000ffe2cd05d0fd8
-
Filesize
535KB
MD5e34a74c4c5bf0e5fe6ab789d00c3edda
SHA1f06894136a7021c3ae252d2b7e17c651c30d22fe
SHA256f11d8e661d16207ee9800e7e1b9292b7f2d219033add3efecb3898c3b11880b9
SHA512f662a705d44e088dabcc6c5b8938498f3a42098184a25b98d51d5ceafde3c0e368fb1e74b89f03ccd02d7aef17ec9bcf0d93197faac90d20f728c82588e24b8a
-
Filesize
535KB
MD543d94f1317b7e597a3de6b3a01a453b8
SHA151ad411e523a90fb8580542071d70306dcdd7424
SHA256bc098fa6522a02cf5f3f96d5bb52bfb041ba2abc43a734609ed3ced4184b668e
SHA512cfe14f20eff3ada162ca883b9673fcf40b44f1d265b7bf180ea20ec06d0aad2a15aeec02b6fcf81983169958f63ae6b9bca42032499cdc14d1e45ee487a0bf5d
-
Filesize
535KB
MD564720b7621fe081291ad866098155a1f
SHA13d5219996f216e87f254f2cf30a0dbf04a68c617
SHA25615d26bd4e07f3c201ea7ff5676ab34fc269622ad7984af33f495d1067a62957f
SHA512964674effed07c1b46b18c45f0544bc81ec14b903b8508561f61b66ac7cc325e05f2a3ee96f3c3cb95c9526bfab61bccc643d6e5306b2eb49e37285797a1f56b
-
Filesize
535KB
MD5a351ac326c6c3349eb5a9a016b89948d
SHA145d48b08c0ba257c4c93d49d3126e87d720846a4
SHA256b805cc112b9e079a5799e83937028382babf96b22e75d1da1d53d21168be6c69
SHA51275959b3d15e4f379f221a649088d36761828fecfcaabc5f6e8742d35a7936feabe115bc5295225ab0baaaad44dc7c7e9faac2e6e19cbafb442a1e9031095e138
-
Filesize
535KB
MD5605b7525cc4ce173ea4a1575860e7487
SHA107d243a73fea7a93f2d43890dbb7116f2467204d
SHA256024fbf4b2685736ef0b1bfe8ae62cee0a6ce3da526a7aba21c8c736c993412d8
SHA512ee6cd529d27adab0d5724108cf40e69be08d717821a11432371f3665847e4a4a12f0c6ebde8712ced643a0339a34050630ec097c62f7f0193a470ce488da6cef