xorddos | 5d94a674992e90b629b2399d37a8a749c68b5a1c4dee28c17a6624bf070a163c

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
08-02-2025 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cvckxesujqpz.elf
Size

549KB
MD5

27e7ff9211cfa5cfa709a199363cddfb
SHA1

e26ee39502fb9da0167da2ea0ab833f263fca32f
SHA256

5d94a674992e90b629b2399d37a8a749c68b5a1c4dee28c17a6624bf070a163c
SHA512

383475f925bf75cd77321f388eedee0bf116ad50204bdea5800e09e164f8a6de82a71a4d1cfef3a066c03748872e252a24de80fa5b0ffb2ad972f9b0f8ee5a33
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmxV:VIv/qiVNHNDEfJKHZ8mG9QeeOV

Score

10^/10

xorddos botnet discovery downloader execution persistence privilege_escalation

Malware Config

Extracted

Family

xorddos

bb.markerbio.com:13307

bb.myserv012.com:13307

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_xorddos

Xorddos family
xorddos

Deletes itself 64 IoCs

pid	Process
1388	octzayhrosx
1391	gfdfmmq
1394	ruzytccgow
1397	vpqdraznhqhmx
1400	scbgvjxrjwl
1442	atbxqyoibgi
1445	trtcfsrxus
1448	rddjozub
1451	pcbfdppg
1454	xjroettwkt
1457	xkictw
1460	pygechlfwaou
1463	xlndeibrbtva
1466	fdychncntew
1469	mseaodzzsegb
1474	yufeak
1477	ersiglocsawycl
1480	dkwjsxopcpmj
1483	otzuktcqfq
1486	ztqxxbz
1489	owkgvbyzskin
1492	bosliwdpmxofo
1495	dpngdl
1498	kgvignuqcusr
1501	fbkjqw
1504	gewrjm
1507	rrrjdahniwh
1510	zbqsrytb
1513	jappgmipapgt
1516	rxkaksxutwxl
1521	hsqssi
1524	yutpwkvptpmdp
1527	ymtrkqey
1530	ohagbuomtkgig
1533	gylxkr
1553	lpbeinxoog
1556	vglzbb
1559	worgwk
1562	uvnfmcsdf
1565	nswcgcg
1568	lrdoto
1571	jiufujarwh
1574	yzjdyxwubezh
1577	mzlcucod
1580	iigtixq
1583	dqrpwpou
1586	pylwhzxsbtw
1589	yibjovtonltfci
1592	rwvdnuqmdrlxu
1595	uldcnotkihxtae
1598	jgohduvxkj
1601	euayzu
1604	fwbtpl
1607	ykwbor
1610	ugtyaqxmzcq
1613	crvwda
1616	ewmpzmbwn
1619	pzmxtmzll
1622	lnehrvcnafkedy
1625	ekwayoszaps
1635	bftpjaiheyjl
1638	oqijvsgxswps
1641	hmmysndneonnxu
1644	hhvxydgvxosq

Executes dropped EXE 64 IoCs

ioc	pid
/usr/bin/octzayhrosx	1387
/usr/bin/gfdfmmq	1390
/usr/bin/ruzytccgow	1393
/usr/bin/vpqdraznhqhmx	1396
/usr/bin/scbgvjxrjwl	1399
/usr/bin/atbxqyoibgi	1441
/usr/bin/trtcfsrxus	1444
/usr/bin/rddjozub	1447
/usr/bin/pcbfdppg	1450
/usr/bin/xjroettwkt	1453
/usr/bin/xkictw	1456
/usr/bin/pygechlfwaou	1459
/usr/bin/xlndeibrbtva	1462
/usr/bin/fdychncntew	1465
/usr/bin/mseaodzzsegb	1468
/usr/bin/yufeak	1473
/usr/bin/ersiglocsawycl	1476
/usr/bin/dkwjsxopcpmj	1479
/usr/bin/otzuktcqfq	1482
/usr/bin/ztqxxbz	1485
/usr/bin/owkgvbyzskin	1488
/usr/bin/bosliwdpmxofo	1491
/usr/bin/dpngdl	1494
/usr/bin/kgvignuqcusr	1497
/usr/bin/fbkjqw	1500
/usr/bin/gewrjm	1503
/usr/bin/rrrjdahniwh	1506
/usr/bin/zbqsrytb	1509
/usr/bin/jappgmipapgt	1512
/usr/bin/rxkaksxutwxl	1515
/usr/bin/hsqssi	1520
/usr/bin/yutpwkvptpmdp	1523
/usr/bin/ymtrkqey	1526
/usr/bin/ohagbuomtkgig	1529
/usr/bin/gylxkr	1532
/usr/bin/lpbeinxoog	1552
/usr/bin/vglzbb	1555
/usr/bin/worgwk	1558
/usr/bin/uvnfmcsdf	1561
/usr/bin/nswcgcg	1564
/usr/bin/lrdoto	1567
/usr/bin/jiufujarwh	1570
/usr/bin/yzjdyxwubezh	1573
/usr/bin/mzlcucod	1576
/usr/bin/iigtixq	1579
/usr/bin/dqrpwpou	1582
/usr/bin/pylwhzxsbtw	1585
/usr/bin/yibjovtonltfci	1588
/usr/bin/rwvdnuqmdrlxu	1591
/usr/bin/uldcnotkihxtae	1594
/usr/bin/jgohduvxkj	1597
/usr/bin/euayzu	1600
/usr/bin/fwbtpl	1603
/usr/bin/ykwbor	1606
/usr/bin/ugtyaqxmzcq	1609
/usr/bin/crvwda	1612
/usr/bin/ewmpzmbwn	1615
/usr/bin/pzmxtmzll	1618
/usr/bin/lnehrvcnafkedy	1621
/usr/bin/ekwayoszaps	1624
/usr/bin/bftpjaiheyjl	1634
/usr/bin/oqijvsgxswps	1637
/usr/bin/hmmysndneonnxu	1640
/usr/bin/hhvxydgvxosq	1643

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc
File opened for modification	/etc/cron.hourly/fle.zpqjusexkcvc.sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc
File opened for reading	/proc/net/tcp

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc
File opened for modification	/etc/init.d/fle.zpqjusexkcvc

Write file to user bin folder 64 IoCs

persistence

description	ioc
File opened for modification	/usr/bin/ruzytccgow
File opened for modification	/usr/bin/ykwbor
File opened for modification	/usr/bin/pzmxtmzll
File opened for modification	/usr/bin/trtcfsrxus
File opened for modification	/usr/bin/ugtyaqxmzcq
File opened for modification	/usr/bin/njcnenvld
File opened for modification	/usr/bin/yzjdyxwubezh
File opened for modification	/usr/bin/sadjxujoo
File opened for modification	/usr/bin/bgeotbxr
File opened for modification	/usr/bin/gqivudfgsgskhi
File opened for modification	/usr/bin/uvnfmcsdf
File opened for modification	/usr/bin/xlndeibrbtva
File opened for modification	/usr/bin/ersiglocsawycl
File opened for modification	/usr/bin/mzlcucod
File opened for modification	/usr/bin/sdunmh
File opened for modification	/usr/bin/hlzhcwkab
File opened for modification	/usr/bin/rxkaksxutwxl
File opened for modification	/usr/bin/ekwayoszaps
File opened for modification	/usr/bin/hljdvg
File opened for modification	/usr/bin/zyqxvdkj
File opened for modification	/usr/bin/fxtjmnkwblywkq
File opened for modification	/usr/bin/agitiqx
File opened for modification	/usr/bin/kkdxpabzlclt
File opened for modification	/usr/bin/xuiygnybswhbvh
File opened for modification	/usr/bin/exefzfc
File opened for modification	/usr/bin/hogzmfwryw
File opened for modification	/usr/bin/rddjozub
File opened for modification	/usr/bin/dkwjsxopcpmj
File opened for modification	/usr/bin/dqrpwpou
File opened for modification	/usr/bin/fwbtpl
File opened for modification	/usr/bin/oyrfokqgytptm
File opened for modification	/usr/bin/gmaxdnn
File opened for modification	/usr/bin/goaavkkupvkdnp
File opened for modification	/usr/bin/lrhhkhfinfarmt
File opened for modification	/usr/bin/vpqdraznhqhmx
File opened for modification	/usr/bin/xkictw
File opened for modification	/usr/bin/fbkjqw
File opened for modification	/usr/bin/hgvybfcrxa
File opened for modification	/usr/bin/ydekeawuhhcbx
File opened for modification	/usr/bin/pygechlfwaou
File opened for modification	/usr/bin/mseaodzzsegb
File opened for modification	/usr/bin/hsqssi
File opened for modification	/usr/bin/pylwhzxsbtw
File opened for modification	/usr/bin/gcuguhshsbogf
File opened for modification	/usr/bin/sqtqjluor
File opened for modification	/usr/bin/ctyzobvibepwds
File opened for modification	/usr/bin/heazqc
File opened for modification	/usr/bin/yufeak
File opened for modification	/usr/bin/dpngdl
File opened for modification	/usr/bin/rixqogz
File opened for modification	/usr/bin/giztlmnusdwu
File opened for modification	/usr/bin/fdychncntew
File opened for modification	/usr/bin/otzuktcqfq
File opened for modification	/usr/bin/ztqxxbz
File opened for modification	/usr/bin/uldcnotkihxtae
File opened for modification	/usr/bin/esijpzksypzwdj
File opened for modification	/usr/bin/jxfezti
File opened for modification	/usr/bin/rrrjdahniwh
File opened for modification	/usr/bin/yibjovtonltfci
File opened for modification	/usr/bin/rdxsof
File opened for modification	/usr/bin/sxcjsorkqwvnq
File opened for modification	/usr/bin/scbgvjxrjwl
File opened for modification	/usr/bin/kgvignuqcusr
File opened for modification	/usr/bin/euayzu

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/tcp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc
File opened for reading	/proc/532/fd
File opened for reading	/proc/1151/fd
File opened for reading	/proc/1471/fd
File opened for reading	/proc/1820/fd
File opened for reading	/proc/1164/fd
File opened for reading	/proc/1492/fd
File opened for reading	/proc/1510/fd
File opened for reading	/proc/582/fd
File opened for reading	/proc/903/fd
File opened for reading	/proc/1000/fd
File opened for reading	/proc/1033/fd
File opened for reading	/proc/1037/fd
File opened for reading	/proc/1607/fd
File opened for reading	/proc/1616/fd
File opened for reading	/proc/1665/fd
File opened for reading	/proc/438/fd
File opened for reading	/proc/1050/fd
File opened for reading	/proc/1719/fd
File opened for reading	/proc/1747/fd
File opened for reading	/proc/242/fd
File opened for reading	/proc/1613/fd
File opened for reading	/proc/613/fd
File opened for reading	/proc/680/fd
File opened for reading	/proc/1024/fd
File opened for reading	/proc/1257/fd
File opened for reading	/proc/1601/fd
File opened for reading	/proc/1701/fd
File opened for reading	/proc/meminfo
File opened for reading	/proc/1087/fd
File opened for reading	/proc/1222/fd
File opened for reading	/proc/1483/fd
File opened for reading	/proc/1698/fd
File opened for reading	/proc/1753/fd
File opened for reading	/proc/446/fd
File opened for reading	/proc/577/fd
File opened for reading	/proc/612/fd
File opened for reading	/proc/787/fd
File opened for reading	/proc/1704/fd
File opened for reading	/proc/395/fd
File opened for reading	/proc/484/fd
File opened for reading	/proc/1060/fd
File opened for reading	/proc/1074/fd
File opened for reading	/proc/1668/fd
File opened for reading	/proc/1568/fd
File opened for reading	/proc/1638/fd
File opened for reading	/proc/393/fd
File opened for reading	/proc/950/fd
File opened for reading	/proc/1466/fd
File opened for reading	/proc/1501/fd
File opened for reading	/proc/1562/fd
File opened for reading	/proc/968/fd
File opened for reading	/proc/1075/fd
File opened for reading	/proc/1480/fd
File opened for reading	/proc/1571/fd
File opened for reading	/proc/1622/fd
File opened for reading	/proc/795/fd
File opened for reading	/proc/1072/fd
File opened for reading	/proc/1516/fd
File opened for reading	/proc/1677/fd
File opened for reading	/proc/1486/fd
File opened for reading	/proc/1553/fd
File opened for reading	/proc/1598/fd
File opened for reading	/proc/447/fd
File opened for reading	/proc/494/fd

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc
File opened for modification	/dev/shm/sem.xvmbit
File opened for modification	/dev/shm/sem.qJ5dcW

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/fle.zpqjusexkcvc
File opened for modification	/tmp/fle.zpqjusexkcvc.sh

/usr/bin/octzayhrosx
/usr/bin/octzayhrosx -d 1383
1⤵
- Deletes itself
PID:1387

/usr/bin/gfdfmmq
/usr/bin/gfdfmmq -d 1383
1⤵
- Deletes itself
PID:1390

/usr/bin/ruzytccgow
/usr/bin/ruzytccgow -d 1383
1⤵
- Deletes itself
PID:1393

/usr/bin/vpqdraznhqhmx
/usr/bin/vpqdraznhqhmx -d 1383
1⤵
- Deletes itself
PID:1396

/usr/bin/scbgvjxrjwl
/usr/bin/scbgvjxrjwl -d 1383
1⤵
- Deletes itself
PID:1399

/usr/bin/atbxqyoibgi
/usr/bin/atbxqyoibgi -d 1383
1⤵
- Deletes itself
PID:1441

/usr/bin/trtcfsrxus
/usr/bin/trtcfsrxus -d 1383
1⤵
- Deletes itself
PID:1444

/usr/bin/rddjozub
/usr/bin/rddjozub -d 1383
1⤵
- Deletes itself
PID:1447

/usr/bin/pcbfdppg
/usr/bin/pcbfdppg -d 1383
1⤵
- Deletes itself
PID:1450

/usr/bin/xjroettwkt
/usr/bin/xjroettwkt -d 1383
1⤵
- Deletes itself
PID:1453

/usr/bin/xkictw
/usr/bin/xkictw -d 1383
1⤵
- Deletes itself
PID:1456

/usr/bin/pygechlfwaou
/usr/bin/pygechlfwaou -d 1383
1⤵
- Deletes itself
PID:1459

/usr/bin/xlndeibrbtva
/usr/bin/xlndeibrbtva -d 1383
1⤵
- Deletes itself
PID:1462

/usr/bin/fdychncntew
/usr/bin/fdychncntew -d 1383
1⤵
- Deletes itself
PID:1465

/usr/bin/mseaodzzsegb
/usr/bin/mseaodzzsegb -d 1383
1⤵
- Deletes itself
PID:1468

/usr/bin/yufeak
/usr/bin/yufeak -d 1383
1⤵
- Deletes itself
PID:1473

/usr/bin/ersiglocsawycl
/usr/bin/ersiglocsawycl -d 1383
1⤵
- Deletes itself
PID:1476

/usr/bin/dkwjsxopcpmj
/usr/bin/dkwjsxopcpmj -d 1383
1⤵
- Deletes itself
PID:1479

/usr/bin/otzuktcqfq
/usr/bin/otzuktcqfq -d 1383
1⤵
- Deletes itself
PID:1482

/usr/bin/ztqxxbz
/usr/bin/ztqxxbz -d 1383
1⤵
- Deletes itself
PID:1485

/usr/bin/owkgvbyzskin
/usr/bin/owkgvbyzskin -d 1383
1⤵
- Deletes itself
PID:1488

/usr/bin/bosliwdpmxofo
/usr/bin/bosliwdpmxofo -d 1383
1⤵
- Deletes itself
PID:1491

/usr/bin/dpngdl
/usr/bin/dpngdl -d 1383
1⤵
- Deletes itself
PID:1494

/usr/bin/kgvignuqcusr
/usr/bin/kgvignuqcusr -d 1383
1⤵
- Deletes itself
PID:1497

/usr/bin/fbkjqw
/usr/bin/fbkjqw -d 1383
1⤵
- Deletes itself
PID:1500

/usr/bin/gewrjm
/usr/bin/gewrjm -d 1383
1⤵
- Deletes itself
PID:1503

/usr/bin/rrrjdahniwh
/usr/bin/rrrjdahniwh -d 1383
1⤵
- Deletes itself
PID:1506

/usr/bin/zbqsrytb
/usr/bin/zbqsrytb -d 1383
1⤵
- Deletes itself
PID:1509

/usr/bin/jappgmipapgt
/usr/bin/jappgmipapgt -d 1383
1⤵
- Deletes itself
PID:1512

/usr/bin/rxkaksxutwxl
/usr/bin/rxkaksxutwxl -d 1383
1⤵
- Deletes itself
PID:1515

/usr/bin/hsqssi
/usr/bin/hsqssi -d 1383
1⤵
- Deletes itself
PID:1520

/usr/bin/yutpwkvptpmdp
/usr/bin/yutpwkvptpmdp -d 1383
1⤵
- Deletes itself
PID:1523

/usr/bin/ymtrkqey
/usr/bin/ymtrkqey -d 1383
1⤵
- Deletes itself
PID:1526

/usr/bin/ohagbuomtkgig
/usr/bin/ohagbuomtkgig -d 1383
1⤵
- Deletes itself
PID:1529

/usr/bin/gylxkr
/usr/bin/gylxkr -d 1383
1⤵
- Deletes itself
PID:1532

/usr/bin/lpbeinxoog
/usr/bin/lpbeinxoog -d 1383
1⤵
- Deletes itself
PID:1552

/usr/bin/vglzbb
/usr/bin/vglzbb -d 1383
1⤵
- Deletes itself
PID:1555

/usr/bin/worgwk
/usr/bin/worgwk -d 1383
1⤵
- Deletes itself
PID:1558

/usr/bin/uvnfmcsdf
/usr/bin/uvnfmcsdf -d 1383
1⤵
- Deletes itself
PID:1561

/usr/bin/nswcgcg
/usr/bin/nswcgcg -d 1383
1⤵
- Deletes itself
PID:1564

/usr/bin/lrdoto
/usr/bin/lrdoto -d 1383
1⤵
- Deletes itself
PID:1567

/usr/bin/jiufujarwh
/usr/bin/jiufujarwh -d 1383
1⤵
- Deletes itself
PID:1570

/usr/bin/yzjdyxwubezh
/usr/bin/yzjdyxwubezh -d 1383
1⤵
- Deletes itself
PID:1573

/usr/bin/mzlcucod
/usr/bin/mzlcucod -d 1383
1⤵
- Deletes itself
PID:1576

/usr/bin/iigtixq
/usr/bin/iigtixq -d 1383
1⤵
- Deletes itself
PID:1579

/usr/bin/dqrpwpou
/usr/bin/dqrpwpou -d 1383
1⤵
- Deletes itself
PID:1582

/usr/bin/pylwhzxsbtw
/usr/bin/pylwhzxsbtw -d 1383
1⤵
- Deletes itself
PID:1585

/usr/bin/yibjovtonltfci
/usr/bin/yibjovtonltfci -d 1383
1⤵
- Deletes itself
PID:1588

/usr/bin/rwvdnuqmdrlxu
/usr/bin/rwvdnuqmdrlxu -d 1383
1⤵
- Deletes itself
PID:1591

/usr/bin/uldcnotkihxtae
/usr/bin/uldcnotkihxtae -d 1383
1⤵
- Deletes itself
PID:1594

/usr/bin/jgohduvxkj
/usr/bin/jgohduvxkj -d 1383
1⤵
- Deletes itself
PID:1597

/usr/bin/euayzu
/usr/bin/euayzu -d 1383
1⤵
- Deletes itself
PID:1600

/usr/bin/fwbtpl
/usr/bin/fwbtpl -d 1383
1⤵
- Deletes itself
PID:1603

/usr/bin/ykwbor
/usr/bin/ykwbor -d 1383
1⤵
- Deletes itself
PID:1606

/usr/bin/ugtyaqxmzcq
/usr/bin/ugtyaqxmzcq -d 1383
1⤵
- Deletes itself
PID:1609

/usr/bin/crvwda
/usr/bin/crvwda -d 1383
1⤵
- Deletes itself
PID:1612

/usr/bin/ewmpzmbwn
/usr/bin/ewmpzmbwn -d 1383
1⤵
- Deletes itself
PID:1615

/usr/bin/pzmxtmzll
/usr/bin/pzmxtmzll -d 1383
1⤵
- Deletes itself
PID:1618

/usr/bin/lnehrvcnafkedy
/usr/bin/lnehrvcnafkedy -d 1383
1⤵
- Deletes itself
PID:1621

/usr/bin/ekwayoszaps
/usr/bin/ekwayoszaps -d 1383
1⤵
- Deletes itself
PID:1624

/usr/bin/bftpjaiheyjl
/usr/bin/bftpjaiheyjl -d 1383
1⤵
- Deletes itself
PID:1634

/usr/bin/oqijvsgxswps
/usr/bin/oqijvsgxswps -d 1383
1⤵
- Deletes itself
PID:1637

/usr/bin/hmmysndneonnxu
/usr/bin/hmmysndneonnxu -d 1383
1⤵
- Deletes itself
PID:1640

/usr/bin/hhvxydgvxosq
/usr/bin/hhvxydgvxosq -d 1383
1⤵
- Deletes itself
PID:1643

/usr/bin/kkitwwtrmyeqmu
/usr/bin/kkitwwtrmyeqmu -d 1383
1⤵
PID:1646

/usr/bin/mosvxpsvsass
/usr/bin/mosvxpsvsass -d 1383
1⤵
PID:1649

/usr/bin/lidxsmqqk
/usr/bin/lidxsmqqk -d 1383
1⤵
PID:1652

/usr/bin/jwhopviwjyp
/usr/bin/jwhopviwjyp -d 1383
1⤵
PID:1655

/usr/bin/veytzblruybx
/usr/bin/veytzblruybx -d 1383
1⤵
PID:1658

/usr/bin/vlnnwyx
/usr/bin/vlnnwyx -d 1383
1⤵
PID:1661

/usr/bin/hljdvg
/usr/bin/hljdvg -d 1383
1⤵
PID:1664

/usr/bin/vxvsdvlcwzv
/usr/bin/vxvsdvlcwzv -d 1383
1⤵
PID:1667

/usr/bin/zyqxvdkj
/usr/bin/zyqxvdkj -d 1383
1⤵
PID:1670

/usr/bin/liwsvfxslmn
/usr/bin/liwsvfxslmn -d 1383
1⤵
PID:1673

/usr/bin/hfoetqbuovtolq
/usr/bin/hfoetqbuovtolq -d 1383
1⤵
PID:1676

/usr/bin/rdxsof
/usr/bin/rdxsof -d 1383
1⤵
PID:1679

/usr/bin/gcuguhshsbogf
/usr/bin/gcuguhshsbogf -d 1383
1⤵
PID:1682

/usr/bin/yiboexf
/usr/bin/yiboexf -d 1383
1⤵
PID:1685

/usr/bin/prisod
/usr/bin/prisod -d 1383
1⤵
PID:1688

/usr/bin/vrpxnxrxp
/usr/bin/vrpxnxrxp -d 1383
1⤵
PID:1691

/usr/bin/psoxzwviz
/usr/bin/psoxzwviz -d 1383
1⤵
PID:1694

/usr/bin/oyrfokqgytptm
/usr/bin/oyrfokqgytptm -d 1383
1⤵
PID:1697

/usr/bin/sadjxujoo
/usr/bin/sadjxujoo -d 1383
1⤵
PID:1700

/usr/bin/lnvivxwjvnrlx
/usr/bin/lnvivxwjvnrlx -d 1383
1⤵
PID:1703

/usr/bin/sxcjsorkqwvnq
/usr/bin/sxcjsorkqwvnq -d 1383
1⤵
PID:1706

/usr/bin/bgeotbxr
/usr/bin/bgeotbxr -d 1383
1⤵
PID:1709

/usr/bin/tcyjtjicb
/usr/bin/tcyjtjicb -d 1383
1⤵
PID:1712

/usr/bin/gmaxdnn
/usr/bin/gmaxdnn -d 1383
1⤵
PID:1715

/usr/bin/ibrpexvtrysi
/usr/bin/ibrpexvtrysi -d 1383
1⤵
PID:1718

/usr/bin/nkxygghkk
/usr/bin/nkxygghkk -d 1383
1⤵
PID:1721

/usr/bin/rqceddpg
/usr/bin/rqceddpg -d 1383
1⤵
PID:1725

/usr/bin/ensbilzcv
/usr/bin/ensbilzcv -d 1383
1⤵
PID:1728

/usr/bin/rixqogz
/usr/bin/rixqogz -d 1383
1⤵
PID:1731

/usr/bin/sqtqjluor
/usr/bin/sqtqjluor -d 1383
1⤵
PID:1734

/usr/bin/fxtjmnkwblywkq
/usr/bin/fxtjmnkwblywkq -d 1383
1⤵
PID:1737

/usr/bin/jguphxjxqageuw
/usr/bin/jguphxjxqageuw -d 1383
1⤵
PID:1740

/usr/bin/sdunmh
/usr/bin/sdunmh -d 1383
1⤵
PID:1743

/usr/bin/ydekeawuhhcbx
/usr/bin/ydekeawuhhcbx -d 1383
1⤵
PID:1746

/usr/bin/agitiqx
/usr/bin/agitiqx -d 1383
1⤵
PID:1749

/usr/bin/psxsmnhvqhbu
/usr/bin/psxsmnhvqhbu -d 1383
1⤵
PID:1752

/usr/bin/fwpzdxdhwoheya
/usr/bin/fwpzdxdhwoheya -d 1383
1⤵
PID:1755

/usr/bin/ozufrrygghdw
/usr/bin/ozufrrygghdw -d 1383
1⤵
PID:1758

/usr/bin/esijpzksypzwdj
/usr/bin/esijpzksypzwdj -d 1383
1⤵
PID:1761

/usr/bin/blsslmxefxk
/usr/bin/blsslmxefxk -d 1383
1⤵
PID:1764

/usr/bin/gqivudfgsgskhi
/usr/bin/gqivudfgsgskhi -d 1383
1⤵
PID:1767

/usr/bin/dnxiriajtmgaug
/usr/bin/dnxiriajtmgaug -d 1383
1⤵
PID:1770

/usr/bin/gmcqjx
/usr/bin/gmcqjx -d 1383
1⤵
PID:1773

/usr/bin/oflxzyejm
/usr/bin/oflxzyejm -d 1383
1⤵
PID:1776

/usr/bin/zjsqtuzpjhpd
/usr/bin/zjsqtuzpjhpd -d 1383
1⤵
PID:1779

/usr/bin/bjcebldvckib
/usr/bin/bjcebldvckib -d 1383
1⤵
PID:1782

/usr/bin/ifvuqufik
/usr/bin/ifvuqufik -d 1383
1⤵
PID:1785

/usr/bin/fjoosfrig
/usr/bin/fjoosfrig -d 1383
1⤵
PID:1788

/usr/bin/kkdxpabzlclt
/usr/bin/kkdxpabzlclt -d 1383
1⤵
PID:1791

/usr/bin/goaavkkupvkdnp
/usr/bin/goaavkkupvkdnp -d 1383
1⤵
PID:1794

/usr/bin/xyahigh
/usr/bin/xyahigh -d 1383
1⤵
PID:1797

/usr/bin/giztlmnusdwu
/usr/bin/giztlmnusdwu -d 1383
1⤵
PID:1801

/usr/bin/hgvybfcrxa
/usr/bin/hgvybfcrxa -d 1383
1⤵
PID:1804

/usr/bin/vbyfhffpph
/usr/bin/vbyfhffpph -d 1383
1⤵
PID:1807

/usr/bin/ctyzobvibepwds
/usr/bin/ctyzobvibepwds -d 1383
1⤵
PID:1810

/usr/bin/hlzhcwkab
/usr/bin/hlzhcwkab -d 1383
1⤵
PID:1813

/usr/bin/hhlyqwbjua
/usr/bin/hhlyqwbjua -d 1383
1⤵
PID:1816

/usr/bin/xviyaxvdrzmda
/usr/bin/xviyaxvdrzmda -d 1383
1⤵
PID:1819

/usr/bin/fwghzzqikoy
/usr/bin/fwghzzqikoy -d 1383
1⤵
PID:1822

/usr/bin/pkcrjznrap
/usr/bin/pkcrjznrap -d 1383
1⤵
PID:1825

/usr/bin/xuiygnybswhbvh
/usr/bin/xuiygnybswhbvh -d 1383
1⤵
PID:1828

/usr/bin/heazqc
/usr/bin/heazqc -d 1383
1⤵
PID:1832

/usr/bin/aeftewkb
/usr/bin/aeftewkb -d 1383
1⤵
PID:1835

/usr/bin/sbahzczxlc
/usr/bin/sbahzczxlc -d 1383
1⤵
PID:1838

/usr/bin/svamehofxqyzu
/usr/bin/svamehofxqyzu -d 1383
1⤵
PID:1841

/usr/bin/tacddw
/usr/bin/tacddw -d 1383
1⤵
PID:1844

/usr/bin/exefzfc
/usr/bin/exefzfc -d 1383
1⤵
PID:1847

/usr/bin/jxfezti
/usr/bin/jxfezti -d 1383
1⤵
PID:1850

/usr/bin/hogzmfwryw
/usr/bin/hogzmfwryw -d 1383
1⤵
PID:1853

/usr/bin/dascerikspoe
/usr/bin/dascerikspoe -d 1383
1⤵
PID:1856

/usr/bin/njcnenvld
/usr/bin/njcnenvld -d 1383
1⤵
PID:1859

/usr/bin/lrhhkhfinfarmt
/usr/bin/lrhhkhfinfarmt -d 1383
1⤵
PID:1862

/usr/bin/ylpopocbspfhk
/usr/bin/ylpopocbspfhk -d 1383
1⤵
PID:1865

/usr/bin/koedxn
/usr/bin/koedxn -d 1383
1⤵
PID:1868

/usr/bin/euwtaylor
/usr/bin/euwtaylor -d 1383
1⤵
PID:1871

/usr/bin/oecctsgulxas
/usr/bin/oecctsgulxas -d 1383
1⤵
PID:1874

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/dev/shm/sem.qJ5dcW

Filesize
16B

MD5
076933ff9904d1110d896e2c525e39e5

SHA1
4188442577fa77f25820d9b2d01cc446e30684ac

SHA256
4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0

SHA512
6fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34

Download Submit
/etc/cron.hourly/fle.zpqjusexkcvc.sh

Filesize
153B

MD5
ffd55bdea52fbccc6462dcbb835c93d1

SHA1
a2af696e5662915ebe06ab4543b8687f3a3748d8

SHA256
e0516de8d19849a5a57aa8ad98ed9024577b5eae28e4d535527bcab875565f73

SHA512
111ce2421312f00f6a6932552ef0b78167504fc8e7295b48a4bc0c4ea508dbb05f0db69692836bbd2f9af0a73e2637ae17677e0a1f53cc06fce052eeadac1310

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
85a5c81c0c8de5143f2ac505ecad9e2d

SHA1
e42d9d5405d3dc041e28f40c087d477fe2a4a1eb

SHA256
435eb940451ff4c0de6db4aa2c7915f605034ee4f87517464419868640b834e9

SHA512
762c613ed515c8d1d61471636e1d340bdcf9fc1aa3ae482e1f19edb2ab00d3852cc0ebf6f45adcff002bdc27eb4ba78965dc025bdfdf80d066d8fad01bb8be3f

Download Submit
/etc/init.d/fle.zpqjusexkcvc

Filesize
368B

MD5
1f024cdc3f07bc55a8b512bfa3e14b73

SHA1
38430538a5c6e4bab4dfd98602b92464f58a523a

SHA256
6316409486fcff50b3de98851ca8d5a97b2d0a8ed3fe343ae9d93d77fd902d13

SHA512
eface1feec1d0cbae2bc79226693502eeee904037563e3046c83c88c0abbae8862d27d6b7e58e93c35f95097bc3692a29cc25e3e8ac4d8b0fc526b4fbb161864

Download Submit
/tmp/fle.zpqjusexkcvc

Filesize
549KB

MD5
27e7ff9211cfa5cfa709a199363cddfb

SHA1
e26ee39502fb9da0167da2ea0ab833f263fca32f

SHA256
5d94a674992e90b629b2399d37a8a749c68b5a1c4dee28c17a6624bf070a163c

SHA512
383475f925bf75cd77321f388eedee0bf116ad50204bdea5800e09e164f8a6de82a71a4d1cfef3a066c03748872e252a24de80fa5b0ffb2ad972f9b0f8ee5a33

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads