Extracted

• • Target

    2857264.bin

  • Size

    535KB

  • MD5

    6147e779a72c49be7d1954ecd328c571

  • SHA1

    3f1d936fb22225d2dea85bd926f28430c811e4c6

  • SHA256

    d360716cab46152dedb9c0b7179d1dc36fc8040be312cf62f76229d1d3145bd7

  • SHA512

    69d2cf66c9ff304cb879c69debe589b304f855bfdc78fe11421e75d4aeb808362101e91afca4ddf158aeed392ec92fb194b68b3b941c9737f981e6bf790b03e1

  • SSDEEP

    12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzu66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5ufjQn36Eu

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalation

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1