xorddos | 2f70458e2b77fba49697e3fbba8bea53e27e7ca010fd92ca3919b819d3aee160

Analysis

max time kernel
37s
max time network
33s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
24/01/2025, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

p.txt
Size

542KB
MD5

f8d19572ff48420a101c685b87d0c099
SHA1

4485c6260a530dbe5680ce8166e63142a93bb9b6
SHA256

2f70458e2b77fba49697e3fbba8bea53e27e7ca010fd92ca3919b819d3aee160
SHA512

4860b6e9dcc8789e22c02140e96992ba18f24ad5e1bb3cedda8960da52f786cbdbcf9f27035ac1925ae0eaad39706c42fe21b0acc20326852c5d9289c247dfa8
SSDEEP

12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXGLLp6yWrk3:VB2WCH/eMU9Uc8gd49N94BJXGLL4ru

Score

10^/10

xorddos antivm botnet discovery downloader execution persistence privilege_escalation

Malware Config

Extracted

Family

xorddos

http://ww.wowapplecar.com/config.rar

hh.vvbb321.com:1525

hh.jjkk567.com:1525

hh.nnmm234.com:1525

hh.aass654.com:1525

hh.xxcc789.com:1525

Attributes

crc_polynomial
EDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 41 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_xorddos
behavioral1/files/fstream-7.dat	family_xorddos
behavioral1/files/fstream-8.dat	family_xorddos
behavioral1/files/fstream-9.dat	family_xorddos
behavioral1/files/fstream-10.dat	family_xorddos
behavioral1/files/fstream-11.dat	family_xorddos
behavioral1/files/fstream-13.dat	family_xorddos
behavioral1/files/fstream-14.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos
behavioral1/files/fstream-16.dat	family_xorddos
behavioral1/files/fstream-17.dat	family_xorddos
behavioral1/files/fstream-19.dat	family_xorddos
behavioral1/files/fstream-20.dat	family_xorddos
behavioral1/files/fstream-21.dat	family_xorddos
behavioral1/files/fstream-22.dat	family_xorddos
behavioral1/files/fstream-23.dat	family_xorddos
behavioral1/files/fstream-25.dat	family_xorddos
behavioral1/files/fstream-26.dat	family_xorddos
behavioral1/files/fstream-27.dat	family_xorddos
behavioral1/files/fstream-28.dat	family_xorddos
behavioral1/files/fstream-29.dat	family_xorddos
behavioral1/files/fstream-31.dat	family_xorddos
behavioral1/files/fstream-32.dat	family_xorddos
behavioral1/files/fstream-33.dat	family_xorddos
behavioral1/files/fstream-34.dat	family_xorddos
behavioral1/files/fstream-35.dat	family_xorddos
behavioral1/files/fstream-37.dat	family_xorddos
behavioral1/files/fstream-38.dat	family_xorddos
behavioral1/files/fstream-39.dat	family_xorddos
behavioral1/files/fstream-40.dat	family_xorddos
behavioral1/files/fstream-41.dat	family_xorddos
behavioral1/files/fstream-43.dat	family_xorddos
behavioral1/files/fstream-44.dat	family_xorddos
behavioral1/files/fstream-45.dat	family_xorddos
behavioral1/files/fstream-46.dat	family_xorddos
behavioral1/files/fstream-47.dat	family_xorddos
behavioral1/files/fstream-49.dat	family_xorddos
behavioral1/files/fstream-50.dat	family_xorddos
behavioral1/files/fstream-51.dat	family_xorddos
behavioral1/files/fstream-52.dat	family_xorddos
behavioral1/files/fstream-53.dat	family_xorddos

Xorddos family
xorddos

Executes dropped EXE 40 IoCs

ioc	pid
/usr/bin/mxujzfapcc	1582
/usr/bin/mxujzfapcc	1584
/usr/bin/mxujzfapcc	1587
/usr/bin/mxujzfapcc	1589
/usr/bin/mxujzfapcc	1591
/usr/bin/feuyalsimd	1640
/usr/bin/feuyalsimd	1642
/usr/bin/feuyalsimd	1644
/usr/bin/feuyalsimd	1646
/usr/bin/feuyalsimd	1648
/usr/bin/klwunijiut	1655
/usr/bin/klwunijiut	1657
/usr/bin/klwunijiut	1659
/usr/bin/klwunijiut	1661
/usr/bin/klwunijiut	1663
/usr/bin/dbficpzebd	1670
/usr/bin/dbficpzebd	1672
/usr/bin/dbficpzebd	1674
/usr/bin/dbficpzebd	1676
/usr/bin/dbficpzebd	1678
/usr/bin/aplgnajmtl	1685
/usr/bin/aplgnajmtl	1687
/usr/bin/aplgnajmtl	1689
/usr/bin/aplgnajmtl	1691
/usr/bin/aplgnajmtl	1693
/usr/bin/eiexlswfsl	1700
/usr/bin/eiexlswfsl	1702
/usr/bin/eiexlswfsl	1704
/usr/bin/eiexlswfsl	1706
/usr/bin/eiexlswfsl	1708
/usr/bin/upcvjmzyol	1717
/usr/bin/upcvjmzyol	1719
/usr/bin/upcvjmzyol	1721
/usr/bin/upcvjmzyol	1723
/usr/bin/upcvjmzyol	1725
/usr/bin/lssnmynpce	1732
/usr/bin/lssnmynpce	1734
/usr/bin/lssnmynpce	1736
/usr/bin/lssnmynpce	1738
/usr/bin/lssnmynpce	1740

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc
File opened for modification	/etc/cron.hourly/gcc.sh
File opened for modification	/etc/crontab

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc
File opened for modification	/etc/init.d/p.txt

Write file to user bin folder 8 IoCs

persistence

description	ioc
File opened for modification	/usr/bin/mxujzfapcc
File opened for modification	/usr/bin/feuyalsimd
File opened for modification	/usr/bin/klwunijiut
File opened for modification	/usr/bin/dbficpzebd
File opened for modification	/usr/bin/aplgnajmtl
File opened for modification	/usr/bin/eiexlswfsl
File opened for modification	/usr/bin/upcvjmzyol
File opened for modification	/usr/bin/lssnmynpce

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc
File opened for reading	/proc/cpuinfo

Reads runtime system information 45 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/rs_dev	eiexlswfsl
File opened for reading	/proc/rs_dev	klwunijiut
File opened for reading	/proc/rs_dev	dbficpzebd
File opened for reading	/proc/rs_dev	aplgnajmtl
File opened for reading	/proc/rs_dev	aplgnajmtl
File opened for reading	/proc/rs_dev	eiexlswfsl
File opened for reading	/proc/rs_dev	upcvjmzyol
File opened for reading	/proc/rs_dev	lssnmynpce
File opened for reading	/proc/rs_dev	mxujzfapcc
File opened for reading	/proc/rs_dev	klwunijiut
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/rs_dev	klwunijiut
File opened for reading	/proc/rs_dev	klwunijiut
File opened for reading	/proc/rs_dev	aplgnajmtl
File opened for reading	/proc/rs_dev	aplgnajmtl
File opened for reading	/proc/rs_dev	upcvjmzyol
File opened for reading	/proc/rs_dev	Process not Found
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/rs_dev	lssnmynpce
File opened for reading	/proc/rs_dev	upcvjmzyol
File opened for reading	/proc/rs_dev	lssnmynpce
File opened for reading	/proc/rs_dev	lssnmynpce
File opened for reading	/proc/rs_dev	dbficpzebd
File opened for reading	/proc/rs_dev	eiexlswfsl
File opened for reading	/proc/rs_dev	dbficpzebd
File opened for reading	/proc/rs_dev	eiexlswfsl
File opened for reading	/proc/rs_dev	mxujzfapcc
File opened for reading	/proc/rs_dev	dbficpzebd
File opened for reading	/proc/rs_dev	mxujzfapcc
File opened for reading	/proc/rs_dev	mxujzfapcc
File opened for reading	/proc/rs_dev	feuyalsimd
File opened for reading	/proc/rs_dev	feuyalsimd
File opened for reading	/proc/rs_dev	upcvjmzyol
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/rs_dev	mxujzfapcc
File opened for reading	/proc/rs_dev	feuyalsimd
File opened for reading	/proc/rs_dev	feuyalsimd
File opened for reading	/proc/rs_dev	aplgnajmtl
File opened for reading	/proc/rs_dev	lssnmynpce
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/rs_dev	feuyalsimd
File opened for reading	/proc/rs_dev	eiexlswfsl
File opened for reading	/proc/rs_dev	upcvjmzyol
File opened for reading	/proc/rs_dev	klwunijiut
File opened for reading	/proc/rs_dev	dbficpzebd

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1670	dbficpzebd
1706	eiexlswfsl
1723	upcvjmzyol

/bin/sed
sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
1⤵
- Reads runtime system information
PID:1577

/bin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/sbin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/usr/bin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/usr/sbin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/usr/local/bin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/usr/local/sbin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/usr/X11R6/bin/chkconfig
chkconfig --add p.txt
1⤵
PID:1573

/bin/update-rc.d
update-rc.d p.txt defaults
1⤵
PID:1575
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1586

/usr/bin/mxujzfapcc
/usr/bin/mxujzfapcc bash 1571
1⤵
- Reads runtime system information
PID:1582

/usr/bin/mxujzfapcc
/usr/bin/mxujzfapcc "grep \"A\"" 1571
1⤵
- Reads runtime system information
PID:1584

/usr/bin/mxujzfapcc
/usr/bin/mxujzfapcc "cd /etc" 1571
1⤵
- Reads runtime system information
PID:1587

/usr/bin/mxujzfapcc
/usr/bin/mxujzfapcc "sleep 1" 1571
1⤵
- Reads runtime system information
PID:1589

/usr/bin/mxujzfapcc
/usr/bin/mxujzfapcc whoami 1571
1⤵
- Reads runtime system information
PID:1591

/usr/bin/feuyalsimd
/usr/bin/feuyalsimd ls 1571
1⤵
- Reads runtime system information
PID:1640

/usr/bin/feuyalsimd
/usr/bin/feuyalsimd "netstat -an" 1571
1⤵
- Reads runtime system information
PID:1642

/usr/bin/feuyalsimd
/usr/bin/feuyalsimd su 1571
1⤵
- Reads runtime system information
PID:1644

/usr/bin/feuyalsimd
/usr/bin/feuyalsimd "netstat -antop" 1571
1⤵
- Reads runtime system information
PID:1646

/usr/bin/feuyalsimd
/usr/bin/feuyalsimd su 1571
1⤵
- Reads runtime system information
PID:1648

/usr/bin/klwunijiut
/usr/bin/klwunijiut gnome-terminal 1571
1⤵
- Reads runtime system information
PID:1655

/usr/bin/klwunijiut
/usr/bin/klwunijiut "cd /etc" 1571
1⤵
- Reads runtime system information
PID:1657

/usr/bin/klwunijiut
/usr/bin/klwunijiut pwd 1571
1⤵
- Reads runtime system information
PID:1659

/usr/bin/klwunijiut
/usr/bin/klwunijiut "netstat -an" 1571
1⤵
- Reads runtime system information
PID:1661

/usr/bin/klwunijiut
/usr/bin/klwunijiut gnome-terminal 1571
1⤵
- Reads runtime system information
PID:1663

/usr/bin/dbficpzebd
/usr/bin/dbficpzebd ifconfig 1571
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1670

/usr/bin/dbficpzebd
/usr/bin/dbficpzebd top 1571
1⤵
- Reads runtime system information
PID:1672

/usr/bin/dbficpzebd
/usr/bin/dbficpzebd "ps -ef" 1571
1⤵
- Reads runtime system information
PID:1674

/usr/bin/dbficpzebd
/usr/bin/dbficpzebd "grep \"A\"" 1571
1⤵
- Reads runtime system information
PID:1676

/usr/bin/dbficpzebd
/usr/bin/dbficpzebd sh 1571
1⤵
- Reads runtime system information
PID:1678

/usr/bin/aplgnajmtl
/usr/bin/aplgnajmtl who 1571
1⤵
- Reads runtime system information
PID:1685

/usr/bin/aplgnajmtl
/usr/bin/aplgnajmtl "ps -ef" 1571
1⤵
- Reads runtime system information
PID:1687

/usr/bin/aplgnajmtl
/usr/bin/aplgnajmtl "echo \"find\"" 1571
1⤵
- Reads runtime system information
PID:1689

/usr/bin/aplgnajmtl
/usr/bin/aplgnajmtl "ls -la" 1571
1⤵
- Reads runtime system information
PID:1691

/usr/bin/aplgnajmtl
/usr/bin/aplgnajmtl "netstat -antop" 1571
1⤵
- Reads runtime system information
PID:1693

/usr/bin/eiexlswfsl
/usr/bin/eiexlswfsl "cat resolv.conf" 1571
1⤵
- Reads runtime system information
PID:1700

/usr/bin/eiexlswfsl
/usr/bin/eiexlswfsl id 1571
1⤵
- Reads runtime system information
PID:1702

/usr/bin/eiexlswfsl
/usr/bin/eiexlswfsl "echo \"find\"" 1571
1⤵
- Reads runtime system information
PID:1704

/usr/bin/eiexlswfsl
/usr/bin/eiexlswfsl ifconfig 1571
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1706

/usr/bin/eiexlswfsl
/usr/bin/eiexlswfsl bash 1571
1⤵
- Reads runtime system information
PID:1708

/usr/bin/upcvjmzyol
/usr/bin/upcvjmzyol "cat resolv.conf" 1571
1⤵
- Reads runtime system information
PID:1717

/usr/bin/upcvjmzyol
/usr/bin/upcvjmzyol gnome-terminal 1571
1⤵
- Reads runtime system information
PID:1719

/usr/bin/upcvjmzyol
/usr/bin/upcvjmzyol "echo \"find\"" 1571
1⤵
- Reads runtime system information
PID:1721

/usr/bin/upcvjmzyol
/usr/bin/upcvjmzyol "ifconfig eth0" 1571
1⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1723

/usr/bin/upcvjmzyol
/usr/bin/upcvjmzyol ls 1571
1⤵
- Reads runtime system information
PID:1725

/usr/bin/lssnmynpce
/usr/bin/lssnmynpce "grep \"A\"" 1571
1⤵
- Reads runtime system information
PID:1732

/usr/bin/lssnmynpce
/usr/bin/lssnmynpce su 1571
1⤵
- Reads runtime system information
PID:1734

/usr/bin/lssnmynpce
/usr/bin/lssnmynpce "cat resolv.conf" 1571
1⤵
- Reads runtime system information
PID:1736

/usr/bin/lssnmynpce
/usr/bin/lssnmynpce "cd /etc" 1571
1⤵
- Reads runtime system information
PID:1738

/usr/bin/lssnmynpce
/usr/bin/lssnmynpce top 1571
1⤵
- Reads runtime system information
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/gcc.sh

Filesize
228B

MD5
3bab747cedc5f0ebe86aaa7f982470cd

SHA1
3c7d1c6931c2b3dae39d38346b780ea57c8e6142

SHA256
74d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5

SHA512
21e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42

Download Submit
/etc/crontab

Filesize
1KB

MD5
f85f0a4cb1d0da23b7e8e4a80a5a9f59

SHA1
f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9

SHA256
696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97

SHA512
a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d

Download Submit
/etc/sedXoMIK6

Filesize
1KB

MD5
e57fd77c50de7b8a8eec19de0ec3f4f3

SHA1
835d38771a0c5b112596ab8841a7904f41c266ee

SHA256
3494e2d3ce0fb77633d00b247cad543cca29c7673da802a23bd5fe0364eb2c13

SHA512
e6103d07bb6ed51cba953a9a861e39a36be0dc37899ec0fa353f5c991f71f9e7ec8433c054ac18a74da0a1c46054ad7cd637a1c64301d52cb0e6ac3d59f5c86c

Download Submit
/run/gcc.pid

Filesize
32B

MD5
d00bad6d7be6af0ed3593e0407f15949

SHA1
3041db77fa2b27ea4d96e78cd4dc81b707a013e2

SHA256
b613bce431dd42930b42421afec698e17a7b32507d194b630d8ae1940252c2dc

SHA512
2f014276b899f84d53b77e322b3da3cbba27ebf0224563616b081af6c6080359436bf26d38623fe652a9364b14af9c61229d1314279bfde77ed76ec0929c8c8b

Download Submit
/usr/bin/aplgnajmtl

Filesize
542KB

MD5
3f68413098c9948f31edb4cb8946ba01

SHA1
0617161ddecddbe3c7c64fe7fec775e281069f31

SHA256
f96a630ec1d590d68ef272348accd03956fdc58e4ba8e47058a23e0b7ddb0562

SHA512
2b27f3a5aaaa0a8539adb3024030005a8c8c904824cccc38f8df0e6bc94048540c883f371993e7bb67da5efd27aa94807d51a25c56ffe61647ba66ed3df7f57c

Download Submit
/usr/bin/aplgnajmtl

Filesize
542KB

MD5
61fca374fd079eb432203c0d23f126d5

SHA1
b6b1e25c7b331178741611dacf63b5f572ab9a30

SHA256
423fb91d8e027bc1b0758b8546b4f2e8a7bdb44fd63c0cefbf9b8b0e883fbc8a

SHA512
7bfb830ef4b173bfcb5e370f3622746363b450bfc0509984dc3711955040f42183ac85529842369c16709f3e22a534054c55dd01715742e25a399064a3d409ce

Download Submit
/usr/bin/aplgnajmtl

Filesize
542KB

MD5
57553e8b62061e720a154200d27b2af7

SHA1
d9c7ffa955e41f2b3d8ccd7866a99220ded06d5f

SHA256
ad4d6a3a7b37f5e5c99caf8c0d571681728c84ef57ebfeacd0e7c10695b7917e

SHA512
692c998f6b91e8f3498e75a105d47941fc8b38cb97d3a8c800c46aa2afa572d73d6bf9667a00d702149737764c2ed452874e4ca2c9b50661860876040a398d9a

Download Submit
/usr/bin/aplgnajmtl

Filesize
542KB

MD5
8ea8b8e3a9873024f72fe067982e3b05

SHA1
73961647d8f697c89ae63cdacfe8a05899764afe

SHA256
c4d0d7a84d5b8a1938fc8d3a84dd23e0123f7eafe4ec8920a6dc50c07f5a32cf

SHA512
16f922b63729d9ace1b8b3bf76e6dd7073cfe7fb0e0026151327c74cfb63b60ee58ab63b94ba11f824145e14995c4e961ecf005b9465abedad138b1eeaeae8b9

Download Submit
/usr/bin/aplgnajmtl

Filesize
542KB

MD5
9f6db613558a5f07c1758f5e56434806

SHA1
b2f010358ee796c8c5692bdf2746ff8ee62c34f2

SHA256
5babb8cbe196abe70097f496f8db066ade0d7cf5384d11e54c924a7544f13a73

SHA512
aa0a4699f7c8e8a5da0217965c861834a90db1b079a0a42245e354a3597af2b0517cf15d3f04c9c86a62f527de8b814fd42cce4b868395c46cff8ef7a2c346a6

Download Submit
/usr/bin/dbficpzebd

Filesize
542KB

MD5
16a0ff35399eae305ce384114f973e78

SHA1
dfc665cadcaa8b5bb7db5f80a12a64ae45baf7f7

SHA256
56427a21055e543ae631d3a6083a2c189f55e33b245adce457577c056fdb32a8

SHA512
885bc460de32ee304f215ddf2b40eab5027cd9cbaf20b4a7ff2d4fc6e0476f7b84505404790657e0cb1b39fe0e52cc9ffc70006100839a38c0e65d1f975d3ceb

Download Submit
/usr/bin/dbficpzebd

Filesize
542KB

MD5
ebf2f92849b688d8bab7ee73d28f6621

SHA1
3109c16565ba990bcf1c03b4a6de2d2292894363

SHA256
3120780f09684f1e1ae17416c45cd3a8c6ac550cd41d38eb70bb3dc772d07254

SHA512
b08e67162bcfd35d2155ff051cb7ec6048de7ad606b63d612f344ee848c7229382342e2067cc0bab9bf68cbd0ced645f73ef5358d717100b8565856ed1fa802e

Download Submit
/usr/bin/dbficpzebd

Filesize
542KB

MD5
ec80fdf2f8422e9541866266685673f0

SHA1
8cc07ee40917573fba612c57f5c8fcd89f94628b

SHA256
ab25b614fc3d7150cb32778a0fbc97ea78d864aa106dae0be7d00f54c10578e0

SHA512
c3e6ce05d5315a21d3be6a687883962cdb01631d62f766b31c0a763276202add7949f5a0a1deb5583696bcfedad158ca46a1b45e32561e7a230233dde7318920

Download Submit
/usr/bin/dbficpzebd

Filesize
542KB

MD5
6d44839a5c4ce27fbd7614fbeb9ed390

SHA1
8bb53b0beaea067f331bdc7bd4f606e7da6808f1

SHA256
d8d6b40d0b550907f087f1ccd5627e2bbaab5c6693546685d6a8070d5e46ee44

SHA512
77bf7cd67ff740f10930a300c84203fca064c6efa10b4d9380cf64e136e04cbd3dbb239bd35d969b893e8eeb14ff43936afde6a2fda0cfc9a4add15d0ecc60bd

Download Submit
/usr/bin/dbficpzebd

Filesize
542KB

MD5
0362d5014e5704836d88509495138c30

SHA1
c7a538ea6022dd22469df8872e18a64cf90d97bd

SHA256
4d9cddb60c8047f75463b5ce873fa38b880e4f495261ab7be2d97989ad8ed17d

SHA512
cb52b6af633ce8d48356960085ef5e1c469ee23c5820702be5d9b5754241347db8e71b86b71222a3fae08f808cd61b6b7872d06fe3d8ba84f59a42f562102986

Download Submit
/usr/bin/eiexlswfsl

Filesize
542KB

MD5
4a16b0951f97fdf5ef796e634d84e793

SHA1
b82db6ce9ae02dddb8c592c43a51238b3556c090

SHA256
3174807ae22d2fcba68a5bbb7099e6c3dca701668e75d035cd5c304c563ec601

SHA512
d44b797f48fc4446ccad9ea4cd7c5cf1091826cba3b571d403dba9b9de7bc017a9b1b7ee6dd4f43ad9fbff943c5ddbcdbf90453890756c4dcaa4c949bb00e9be

Download Submit
/usr/bin/eiexlswfsl

Filesize
542KB

MD5
0743316afe767187ffd6e1e2808d54eb

SHA1
ddd26fd4c7b626de3dec43a20f1eb223085029cc

SHA256
220cfb052494bc2e7622956d8b04ac6003b0a74a7a545c64b9c80623d6a10e1a

SHA512
d65a644aaf9992abe3f243830cf43ab919792b1f1ba9ace3b75f8cbca25f7eef6a915c918e57cb25c955dfed8638d0e62c70dec60d7f21fd27f080b3f650f90d

Download Submit
/usr/bin/eiexlswfsl

Filesize
542KB

MD5
90cb7bf0d61b5a737952cc8b1c5b4dca

SHA1
1bf27a7530812504f8be326c08b3e21ea22a6a38

SHA256
9503286788394adc772e983bd60659ee07e359891f53a1d1c1618fa7e17fdaab

SHA512
576ca6eb9f001b1bda5b80188f2bed00132ca177172c221c25893b2f6f4835aaf63557998525fbddf36cf926cc9da026c28201f8b4738683672f955cb5415407

Download Submit
/usr/bin/eiexlswfsl

Filesize
542KB

MD5
c540bdcbe294f251ec7bccee0267829a

SHA1
e93f13085ec2cda675db42f838991a77cdb1cf55

SHA256
f788683aa1460fce895d4e4c0cbf809a737c27d2ca52e2974974acca4e799963

SHA512
7defc9ac4f16afd6985d9c4e93ac0cafb2dccb10b04dad698ab348f32c68dd73ae4225704c058ea4c574bcb8f2a34475c4f13e3af79a3e29ad2768258ed4fdfa

Download Submit
/usr/bin/eiexlswfsl

Filesize
542KB

MD5
7f8484bf764a6cecbac8ae2a271d1060

SHA1
62f01faa55cd953b3246cfb897fac460796a77ca

SHA256
fa9068a1b2a0ded20de4f49d2b12fde4080c478e7413c2a6f3296a21cf16514a

SHA512
93f2d6222f8b313fa928e6fbd3b42e2f3b5b7cfcaaad1f7c2e0aef18401372fa002866db766c7910a2045fad7a7d764f0d5aced8edf6614e4010f726187181d8

Download Submit
/usr/bin/feuyalsimd

Filesize
542KB

MD5
3859235686a48384e121b51cf8865d2c

SHA1
b9a5d4f1a64cf7ad6d8a8e1c303ebfdaa14178b3

SHA256
ed127c29d0e43ef25f2e0153939c27a489ba4fe206b86c9b2e99dfc84d3a4a2b

SHA512
92ee50ec969db275fb592ccd8691b5d365035ad8fe3b398811db92196106b7e0ced8b05778d561f4c90fce5273f94ae332897adae444d44f34e437a60a3b7c1f

Download Submit
/usr/bin/feuyalsimd

Filesize
542KB

MD5
641fdff7c84477a46ae2ab50dd93b4b1

SHA1
2c4aa292a7012d39c66017c3b99d053a2129b295

SHA256
7302d595f04be21564fb02753de5ba70e4bd53c38155feb5589243b999f33ab0

SHA512
f98d3694a403a2db4034c3e0cc88fb946e2c020d62f9ac1da25c6b9f8900a6df12964b4c28ed82256ec0bd4803d60e59f0dcff6b878f5ae18e6aec512871ddda

Download Submit
/usr/bin/feuyalsimd

Filesize
542KB

MD5
bfd945361bb67d81b97946104755743a

SHA1
78aaf56188f8ee8d7ffa1b9fcb9eab1bcbd58ccd

SHA256
5955caeb9d24853f8cb6803b4f65b02a56f1b8f5d8af29a2e7293369b4ab42c1

SHA512
f6ab07f19ddc4fea32c21bd6a4c585cf3229398fb9da75fda4ad6e211a680e1071c90fd3ab4b8573f664465264fcf2fda63837202466da5f6929abb3a6a3c696

Download Submit
/usr/bin/feuyalsimd

Filesize
542KB

MD5
716afb3bcbd4ae75e423ddc9d5ba417d

SHA1
3aede02d583f16a51fe75aa38542f0f5e75ddfca

SHA256
adafb20a6a2880b78a57b01c90078e29c17be16826ac0c9e6f31d9c3490faf0b

SHA512
41c8c27ed08e164acda2dc5c37f75f71ddee15e9aef693a71d4b92ab7e53b296c0c5b9cf0a05570aaa8de2df88694bb4e90a29692cb1f8972a868474c41fa715

Download Submit
/usr/bin/feuyalsimd

Filesize
542KB

MD5
ea6c6c5c4d60b2697bccd3a505c05b68

SHA1
d66fbe02a39980a290d0378a1527fba0e61d71e6

SHA256
6048a1fcf16fa97c519d76f990d066263209de906717d2da4b143316c586c06a

SHA512
dbac6711e8f4be811c922d5717c7aec1efe07bc7fdaa314c8c33f7f7854f306b08c08d8a8309036efa8c067f4dc840e56d3acecd9e9bcb4c0ebb5fbcc86734c3

Download Submit
/usr/bin/klwunijiut

Filesize
542KB

MD5
3173bf21667e9c1ba2b8c7ceb7de0d66

SHA1
e5abb9540a83be582f99bc34445d51e624aed63f

SHA256
477887c45214241e86213fff8aafe3c699420ff80fcced17eab1a63706337611

SHA512
677f0cab51be8505f85847960e2e198b3f2f2fbef8a29753c3ae75f944f2c0957c58f94cd2ed3907b853d7e2e62a0b9ab26011b082180e8b452b4044284f580d

Download Submit
/usr/bin/klwunijiut

Filesize
542KB

MD5
90a0da1634cb933be878fb858c07c3c4

SHA1
e65d833de60e88ad6456eadc4a4a769e49121daa

SHA256
77ec5cb1981feff66b4161d850b826a12fa06bcc0d314c99c477cfa53311bb3e

SHA512
971a087b382266906e7d3af818721b269538f4aede80caa80c540d1a400f7bab4b3f50b7ebec6d3960bea4035c0c2fa588861e1daa6ffc34ed9281e8730158f6

Download Submit
/usr/bin/klwunijiut

Filesize
542KB

MD5
6895bd18e6809b7e77a213234cb4498c

SHA1
10b0f511cb426226aaeb56ace113698574c099f3

SHA256
41ebb95d186d4f0902b9423f9bac6cab8b1c109a900ef2e59c17f530313058c3

SHA512
94dee4f8be5125bc2c1f1b23c8d6b404eb6fe20e93fd020a7cb6ea85038397ad50135001151c3471e2cae5af6a148eef1bf3b44d9116e6e6a6d14a6b47aacb83

Download Submit
/usr/bin/klwunijiut

Filesize
542KB

MD5
975b0c6a90514495143da08f0050c6eb

SHA1
0ca84e62dafa3c724e0620928e696b153e96eead

SHA256
32e615e9838f3b117a5fcdb01e3ceb9028436fa4e44df8116735d05596db64aa

SHA512
5ea6456e1b271286d931530962c60f95bb9690198c12689247f17149fda4310bc23a509d03915c9039cb176668c58897f3753be762e5d5297d76d2b797d62c68

Download Submit
/usr/bin/klwunijiut

Filesize
542KB

MD5
73b6803e894f1a52744bd38a58752c78

SHA1
829af3ca19b2a6bad68bb4c190e58d96cac3bf49

SHA256
ca20eee4267239be86ea2dcbdce16047d898a98a8fcda549ae78ec6e5cd1d5ae

SHA512
dd762f09aee77278cfc729ff240c1e05f09693664be931e8bce99632b09ee5b2fabf17456012ed6035b294d1b82b8622f16660bda3cc33b160166075c82f4968

Download Submit
/usr/bin/lssnmynpce

Filesize
542KB

MD5
375289e4e9d5b0c9aa65f396f8ce2c58

SHA1
05b8b29f0899af67410873a4bdad49641bea79b4

SHA256
f68f99e788c8110e24e8cf56c2f2986bd3ea565519631d7ff064110da606a57e

SHA512
bf2824754ba00ea7f5a8dcfaa3780c49894f71e044aa346b321276607b687dc4615124a51ab432b4ff70f7c6ff0766163a49ba39e74de43b506dd1aae454eabd

Download Submit
/usr/bin/lssnmynpce

Filesize
542KB

MD5
fa34146cf8c4147fe6555f7a42f73715

SHA1
f3d27525eb5865c1e6e64c1dcd709f14615518d6

SHA256
2319d90a55fb579b9273f3be425984d5cce82b32cfa3dd1ecbb7767f7c4968b7

SHA512
8338da27a58e0fffef14a168826d2fa26c2f6966785b6e71430bb853703426abf76a1b5b0ebfaf95059955d13ddb7fd6e14e4d627ad8691eb5a9760d93884bfc

Download Submit
/usr/bin/lssnmynpce

Filesize
542KB

MD5
cab9c6fbc26891a477c3d669d7ecd55a

SHA1
e046ad4a08065ed2dc2a1a6ae3d3af15976d3118

SHA256
1d18181228ef33442df17dcd972861424082bb713f275d68176c86e8cd9ce170

SHA512
8190059bc77610bc67ec55de1c66b8b425a85906db5f2d6093f68d4b08628157e1d58a7fd477e8426b08240f1882f66064972e18d3f76ca81fb5bac8e106e6f2

Download Submit
/usr/bin/lssnmynpce

Filesize
542KB

MD5
50f4451bf73c7d5fead7d90101f40055

SHA1
8ce58a4456cfbdb1422c64cc8e767f15d7b9c052

SHA256
a448b4657cbdbb110abb37b6fa99b1703a7bf5fb21784d7afa511cd9d011f991

SHA512
8b615e86d767b62632fd3d72bdc105c9257abb2e2462463612a2260c73ee497ba6f8f236d6cc97250f15e281a3a4907db4dc66eacc2f785f8a66f90b8eaf536d

Download Submit
/usr/bin/lssnmynpce

Filesize
542KB

MD5
798370184c4791c5a7926d8ff94e6d90

SHA1
96f690ddd759a59e1a8bb9e9617f6ea3980545ca

SHA256
55b4317aac5f9340d2abee11a512786258b22eee852bfdfd4c9e4c2ff1d3098f

SHA512
040db443e364854aa501cf578c0b51d46190b330bdfa859c668f81cb0f82e1d336de4f69248ee0036811e62ce15172f9460264dc709f2c43607963b7455871f5

Download Submit
/usr/bin/mxujzfapcc

Filesize
542KB

MD5
cf3429d8273b24efe556e100b32b30cf

SHA1
6ecb2289297d41082a59c6884c6523a67ca0fad4

SHA256
81da88ea6f7b3716fb45782c20b5f5fb44ad8fe3cbf0711bd7c3e627103efa08

SHA512
bbc9e6d887ac3b330a435115210f0d37e1747fb72f5bb08acd6a99441a91d3ca601fc600eb158cc861cbb6dcf40fa9355929e037243bd0ae077d2f88487d8cd4

Download Submit
/usr/bin/mxujzfapcc

Filesize
542KB

MD5
d52eb93c357e102f35c82cf155af0ca2

SHA1
d049d76cd208b46e9e48bf46cb55ebef9e10d010

SHA256
1cebc991accbec78130f541f7d4ddbec0c1b01d5c66d407924cc7245062e58e0

SHA512
cd12ef14b41f97f5644a3284f78c6ae2f190d26e35f177cd204c2f65057dd68073df9de89c84d899dca199c579a050850e09a6d45b1f0564dddaaca0ff81adc3

Download Submit
/usr/bin/mxujzfapcc

Filesize
542KB

MD5
b479a1e084aa0593db0a2aeeec77da90

SHA1
1f0cc751518a76df495cdc7a00903ffeeb84558d

SHA256
7c90eb8163035108cbaeeaf9d442513c8f816b5816be04dedfc6f5de6750ef19

SHA512
22036e50a1aadaf7da52eb3cb4a9961e7cd89483c8f70525019cb3a80ba96b3eb845728f25a29bc83c1a8fe69c8fcbcd621598d2e88d47432c98657a8ba714c9

Download Submit
/usr/bin/mxujzfapcc

Filesize
542KB

MD5
5056f0802f35318c5cc3e90a06c048f4

SHA1
fb2f348deb7382827c8c287f0f8132285c7b907a

SHA256
e5a5b7316d247440615554338bfb7f4399774fda0ea835e915c117c182cd9eb0

SHA512
fe8dab06222351cf391f283d4126502d9d2c6f7ed83cce63538cf3b71ba3b4bfd2b4c906c571d073a6efea1951a18de19ad5614fd1c2ae8cd51f7f1af7292c51

Download Submit
/usr/bin/mxujzfapcc

Filesize
542KB

MD5
eb7a8b6264e25346022a0a77d035e668

SHA1
de6e14047f57351d8d7699631a071f70b98ebb65

SHA256
3d59468d2cab6ab29568cd094daed9fb0c9b823bbc282098ffd4197e13a656d0

SHA512
560fa15065809fdaaf403ad0c685b62e8e3fb89b6d6893ced4ef7cbc616944d00de58f17d961c2af50e7a7a7132caaceac79ebff23fa02370a87cf9feb9e1b5f

Download Submit
/usr/bin/upcvjmzyol

Filesize
542KB

MD5
151ad37ba2ad01a4a882cc3eeefb5374

SHA1
5bc3cedd771e5156a344f953899cb9f48e0dd105

SHA256
ac0caa8c6c986743598c7bcd0abe70f4f17d278e92144577ca746516a672e93d

SHA512
08b54fc95f50264cea899b5e72941e56ee4129155931e9991adb32d5a154e37dc2081dbb901a44525ad7ca00a67e82cd25568985d1adc500f275a151950da54d

Download Submit
/usr/bin/upcvjmzyol

Filesize
542KB

MD5
f61fb925dbe65a84a066f4fcee2d7449

SHA1
ab09768c60f3075fe6180921ec45accb591e6269

SHA256
3622520d93b0c01a28741f818cfd676cab3daf4cb3b2a992fd104a17a4391d0d

SHA512
d31b36850ea375f7b9b5b7bc90a33a0320721490036c7d7d29cf6705f1ecfbe8a5279545698b2d4d8df8d8ba00fe97fa014d68c800c06b5f9ba69c39f0fb42b5

Download Submit
/usr/bin/upcvjmzyol

Filesize
542KB

MD5
f005a91f4dcc1a1ed4f993328e2e18cf

SHA1
0ad49fdea294de9ee3a7643f8045fe76dcc8079b

SHA256
8426a034428c18fdce9672c97162fbaca4411911cc2eb81995d774d032e08d4d

SHA512
ca100ae28d15eab7a05e6dd1d0b0d5adbe249fb3fd58ce96be67db074dd2561fcbc4e9c15f7951964df82787eece82feccac334d52318dc2c3bbd9d9a9f3348e

Download Submit
/usr/bin/upcvjmzyol

Filesize
542KB

MD5
69872392919d8bd07226b1723789baab

SHA1
65a298e4288880e87dcc92ca20697cf5f69ede6d

SHA256
5347557447419f7836c09f4e95cade7b32466b9cf36b15ab27c1ca17fd319e87

SHA512
e4aa644aa62ae5bfbda6a9358c534c6234f59e31f62d656033cc95f74e382d66b64ac8197e466f8abed250013b1faadfbb03c2652fe7f977ff7917539ef8a56a

Download Submit
/usr/bin/upcvjmzyol

Filesize
542KB

MD5
692983517bb876e4c80757c9e575d3c0

SHA1
ea3c6fbfebd75460718336b8fd95d544c7090958

SHA256
980eb00d686107d6413d97a9e61923ffb5343403ba472d87481da9e4f366e7de

SHA512
715362e4c3cbaf8c381cab7951bed8705e8886c5b36f454dfe92708b4a0a71b45deb23e23a8ec43cb9945954f34ad1913a304c99baab370a16c86cbb3120a05d

Download Submit
/usr/lib/libudev.so

Filesize
542KB

MD5
f8d19572ff48420a101c685b87d0c099

SHA1
4485c6260a530dbe5680ce8166e63142a93bb9b6

SHA256
2f70458e2b77fba49697e3fbba8bea53e27e7ca010fd92ca3919b819d3aee160

SHA512
4860b6e9dcc8789e22c02140e96992ba18f24ad5e1bb3cedda8960da52f786cbdbcf9f27035ac1925ae0eaad39706c42fe21b0acc20326852c5d9289c247dfa8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads