Extracted

• • Target

    usr/bin/ygljglkjgfg0

  • Size

    535KB

  • MD5

    694a672878a1f7945c020a0a3ca74367

  • SHA1

    148caeaa8ac7fdf46d48fc2d1d0020d1bf41d442

  • SHA256

    75bfd448e4274cc4e5804c43768f62a36ccb3fc3b1df06e14d9c892daa2cde19

  • SHA512

    a239845b91d64b8559192e4683e2faa16ad0c8987bfc142cf692f620bd5fefa0d8d0bbe2e7f5f59651435eec4350e3574171d33e7cd4656136b539bccd00fb60

  • SSDEEP

    12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzP66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5PfjQn36Eu

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalation

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Deletes itself

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1