Extracted

• • Target

    cvckxesujqpz.elf

  • Size

    549KB

  • MD5

    27e7ff9211cfa5cfa709a199363cddfb

  • SHA1

    e26ee39502fb9da0167da2ea0ab833f263fca32f

  • SHA256

    5d94a674992e90b629b2399d37a8a749c68b5a1c4dee28c17a6624bf070a163c

  • SHA512

    383475f925bf75cd77321f388eedee0bf116ad50204bdea5800e09e164f8a6de82a71a4d1cfef3a066c03748872e252a24de80fa5b0ffb2ad972f9b0f8ee5a33

  • SSDEEP

    12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmxV:VIv/qiVNHNDEfJKHZ8mG9QeeOV

  Score

  10^/10

  xorddosbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalation

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Deletes itself

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1