Analysis
-
max time kernel
156s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
11-02-2025 07:43
General
-
Target
beujewgbbg
-
Size
535KB
-
MD5
612f2688db8091e3d3cba6e3e49faa32
-
SHA1
b6109442295c0113813541bd6fa6c1a9f89a9f81
-
SHA256
86e1697603be6fda3f01b976e320d3965e3252631b0798ae24bdcc555d1f36b7
-
SHA512
bd0e083b05b6f418c922e5308a20aeb69194c0655e1354b698b1fdabab5fcca3a2d5e279680b4ca1dc476f869765e1c62f722e54cae395baad86dbcc8f9ce81a
-
SSDEEP
12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzP66ySjQn36EojX:/fUywKQ7Fb1pNL/p5PfjQn36EuX
Malware Config
Extracted
xorddos
https://ww.aass654.com/config.rar
ee.aass654.com:1520
ee.xxcc789.com:1520
ee.vvbb321.com:1520
ee.jjkk567.com:1520
ee.nnmm234.com:1520
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 32 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/beujewgbbg/tmp/beujewgbbg1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
315B
MD5c022d4373034f867b3a90532522c2fa4
SHA17d9dcaa240985b4e1491627e3ba791d0e99f1148
SHA25633d8f7c6c84794094fc77bd210653fd4725f4c2760b8587126dcb05d4ef7450d
SHA51220f485eb3293074fd319fbc5dd843e8beb414fadaeb478b034451e43fb18789cc116adb1ff7efadc48db816b6a0712e43d11fb092aae774b6973933026009ca3
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD5ed442c4b90c8499afa82a54340845e65
SHA1e249509febc22295e07c3fdbb14ecca2fe3c9db2
SHA25650baa3ebb3a1c6b8fb1b03d7555c52f0bdc644df67f8acd2912813813032aeb9
SHA5122e4364a7a53bf32502d2df71271748ce1091227930ac478193c71ae67a2a1cf7bdf161a4e80d99ead65c2ec42bb11503965e1543fcb89b71bea990fdb0d5385a
-
Filesize
535KB
MD59ed407bb0d3a86b5499bca61dfd32c58
SHA137944e5165e401e0cea319862dcf9a5e5c23125b
SHA256d2e5d7f14051df6cb25d8c9a6e1137bde95418867a9789157f281a7de0fb149c
SHA512527799c6078c4ba6a3274e92101ee50e31d8ed830e6ea947f8ec98c942abfd8e9b3e938a6c54999167e6c34dda1c78ebccc3ed9b52c8f2d8c576a4013b39defa
-
Filesize
535KB
MD503a8276cd90a79e913590ae7ba23aeac
SHA1241622d75c3263c4104beea2c29da08379876b17
SHA256e1d1ccd4495fb1c201a6012e698346f9ff9a5daa7ea0b3c8834712af866c7e1b
SHA512c7e4bc0474dd00fe238eeae6708ced0e778bd3df5f92fa12af0ad07225b148d88d180cfdd59c284f90cad907fc3fad2a4786a3987e23d59ec2b37036fea68c4e
-
Filesize
535KB
MD509e88f0e17bfb459665d9eb22ee632a1
SHA16b0f13319d46ef84a205eaabc43eff8f7b4e9a59
SHA256687c0eed036212583af6047780ab66958e3928dcf920caf0686ba95c7e6aa9bd
SHA5128d82bd7060f57cad6542761c3ffa7850d6a90be44ee60da39ba8be33bd65dacc36e19f794dbd6ceaea4b00a1a59ac703a37d2a0e4cc45607ec24d8b91b84da71
-
Filesize
535KB
MD5ab70f48b80ad449851b8a2a89054b0c2
SHA188d459546bb630fa3eb40998a900fc6cca218fae
SHA25626e5ce76fe9604701ffa1b4e5c821d95396dd85f2597e048f60635832789ef37
SHA51267db6f73f68b690211b53e06f792e593b31298d6614e57baab06276c4605359ed516c7f28e9d5c98f6a2de7b775255c5df8010548430e3ba6d53f7b5142489ed
-
Filesize
535KB
MD5fe247955b4c58c78ea70749aa4f9d1aa
SHA1d45aba82d9d4f76d4185bb2d737c8fe6b2d2efee
SHA256be2b1b6f247797ecdffd559c6ec2a25715b711daae6ace10775d738d9ee4a745
SHA512b6e1fdfbd63dc46ed4e7853c4a10ac66328555a4ed5676361e6202458770e3b08666605948a4bd2df5c93318bbb85a502ec5dc8fa41df9f74cdc73de33fbe551
-
Filesize
535KB
MD584782207a7e1407750419cd887ff501a
SHA128f784638d79c062bc0b579ffbfafbd3c2ae182b
SHA25686110bf28a4d0f968738586e4ede4e8c57e69bdccee9a1c6784aead7b9e1e749
SHA51282f21809f23b3bc0192040ab0e41e3a9a9f66f197c8f75fb63bd0e4179e5250616d23118013bfcdd9ea10baaed9ef83d68bfcd26007a57dc8b8bf553d306ba14
-
Filesize
535KB
MD572d90992b14bf9194856ed90a7a9c350
SHA1092330d2a70e3fe7ab3adf09061cd27f509d00d4
SHA2565f6d5ddce0570a79cbdd027ace62d2cfb00d872f20f1222c3efad25865d20dac
SHA512ec61197a19d1d4fa58f76dee1fadefbac236534f879cd8670961848ff451102b3a87f390998f79dca8f37692d4347991512ebfe47120ab3072fe003bee001c87
-
Filesize
535KB
MD5ef8ddb7dfdb4cee24b55ea399a7615ec
SHA1ebcdfee574692d1e07fdc5d7bddc488a6d7f49a0
SHA256e7be4dc14e67f760995f44944b4e7cb56295f8df4021f21162dcb54c8d82e8f9
SHA51224db121449ac522467d3fb339a4960019061419d4a7e39420e49cad3ac0ac323f8e84712c46b1050651723a55828c1244f2e9ab4f120dcd5e9009494cd6684ed
-
Filesize
535KB
MD5397ce6dee7c0b8887b64ce6ab2a81cce
SHA1bc1919a37176b019d81b2bb765a1b3b4e3f75ac0
SHA2566f879ea19f788fa836799b945f61153e51ab5e841c5ec6cdecb2cd16e337b477
SHA512990fc63cb199813354432ca378b150ecd08edb5f3ef6bc2ea54af6f44a8da95554e19f18c23b586e0ce29c5db1e699ef670f6768a87751072a0cd00fd6114181
-
Filesize
535KB
MD5c6780c5e24252a30198973cdfe03325c
SHA12e513ea19277f45125f34ab9f70bc3a11c2a6e22
SHA2561446eba9d474ed6b35d8ca022419ff628fd7384db614068c818efc48117e24e9
SHA51245f3564b4ecd3bbae34d56bf6c68ec7a36771846b688cbc3c09496f07a642979071bd9014e0eddfa8e4c0ec9c56fe4b9b47961cad7d0c7ba50453292ac5c3468
-
Filesize
535KB
MD5ec5615540c1b7c39ce52c3167350aecd
SHA194f2ee2ffea5d0f63017ceddb58af56e8e866b35
SHA25676d36d35955ca1dcd125447d80175aa1e805fee9c93ff6a0b01664499e56bbd8
SHA5129d2b169021302eb259d074f4766f2c58c9bb0cccf28deaeea3d3b852570cb423149e381f56ffc758b17697b358500bdd8077e659bdc64a00eda1d66dbcc3f43e
-
Filesize
535KB
MD5c006cbec852b31abd1e03c0b11dd1ab7
SHA10d8122c14bfa4c7059e376b9716e3f703d00789f
SHA2560d43b1330e5a968b657957838c30101c7fa25ce594ef631233c5384c32f373a7
SHA5120f137b16f8ded958e4144aea72540663a8d04d94075813cc6ee607665e94c910e053a1f80407bd6baa02f90110b48054489aec6cb466aeaf0ea46fe536ba628b
-
Filesize
535KB
MD5ad3d1e95cbf39e55e9f485cf4b2431ab
SHA11d0c04dfa4f5102947eddc80b15cbd840bca41dd
SHA256cc1306e1b13fa858afe377a16dcad716009bd23056d5f72ed2879681c7f92be4
SHA5120fd4834afad4add13c2823e92bfe454d174d220b6a468fe056fa083b802ec803ebd0121c607ac0b35f1542262f0e7759cb1ae03d2dab22eba7fa49995698c4d5
-
Filesize
535KB
MD51aae498ce024d17a66158a86291b3d7a
SHA11a8ff693d3f7fcaf1620d09add6a51af88eac3a2
SHA25613ac60fbd8067e9e6f955032568d6d48c8b4af4c069bbe687ae6289c97d9fad7
SHA512ec6d390195b60739c8e41856835233503d657ad80a7966f6b989ef2c2c6023e3637c1083a58cc94ce4a6c40077cc2591bbf354b770da8870c5757e0abac0e475
-
Filesize
535KB
MD56a3a86e01244f775719c9c5a395076bd
SHA1a59f828fa283b9e34dab79db2e98ed98b850cac6
SHA25608fa4edbaa5582907512ec7d0f49598ed91266e14f2bc1b3b9c698814e90d685
SHA5125535ea134094f421c578ff3468f56f79ba59e6259cad45b6d2e11e0a181ca592bbeb39c76101b209d5d8589f19d64c91cd6e43b8662f636945dab3d0b7e2f746
-
Filesize
535KB
MD5133997a54821890fe403d6eae99aa7cd
SHA12d93eeba729592e352ebee4179745ac22d2c2eb2
SHA25643bc08fcda4c409d8a8f2b38050b4aa8281616a9b7bb55b999aec6eaedd82e20
SHA5128f746a9289fd54befda8fd0ba22783e665235cc850086f35bcc15bb8f54d3ec1addd1b3422635c3aac20db7e5ea41932ca8e1ba218dda501338db94bbbe6629b
-
Filesize
535KB
MD52c2624ae87e6abf179395607ef0de637
SHA1a8bb43c3fa79a6705c5019a21e48e150c2f78651
SHA2569af530cbb5903a0473660677b29e0f6ee0d7e4aa175b005dcbe3d433d731442a
SHA51221fe0c6a5cfef6d3f06f855ae435f239494c88e82ad35fa04520b05133ff058dd746e5de6593891e06a0d40f1345eecadd303a6b048f382628b8937ceb899adb
-
Filesize
535KB
MD5429d61728ac0aace481354eb0b73036e
SHA1256587cc1be3af7bf7fd57dc0590b983fa575f4c
SHA25649b4bf95f0c7653cbf6e2a7152ec0ce6f09a40a0194f8a18bde815d303f11a96
SHA51247ac7fcca44a612c5bed2f9367fd1e7ffcf31e26f3de25760bb440abfc7a949a5138777023fb74860c0a92ced94c38ca0e8f453d1f46e6202b5266d636298551
-
Filesize
535KB
MD54f6dbba55c72051c4417c9e99c67ef55
SHA123e8edb2b4aeada7fae44f036f1809920e2ff8e8
SHA256540177f5a2382fbd09317dfc44dd31ee4964229459fe51e70743cc817ae3554a
SHA512462b78a9fdf5152328341ab7ec7dff8e28a79518285abeabb5be07319515ac8c96dc5b3f2145c9c399855bf4aba05defd737a20843e4a70d25b8366f1cb309cf
-
Filesize
535KB
MD5e04fdd799b93c86982ca64d5017205d8
SHA16e64b90964d2b3c95372725800aed7d6d995de57
SHA256b745615a490a4b715213cd3a7548420eee076f8ae607a8d394b7e068d31c9fc9
SHA512714061168c9e2442c40aad85cb6ab14a7e370eb40b994199f78e1e4639e2864892714b63aebb4eefecb3a05bc70779a44fe171387b432fb3513d3910cb230137
-
Filesize
535KB
MD5dc1e546b859785a4ec7143ee994664c4
SHA1bd96429cc7ef01774162255d1a4d60c372535464
SHA2568597378bad76d816962af23323528fb33cd5c493fd308e1bea4f0742e0873de9
SHA5129518381365b77a937c8265f85f8d7c073eb1240604f302710bda783a484ecd22cab79c7e3bfa633370db64e7b85c698dfb6a70506a9fcadd3c3f1a970f5b5d47
-
Filesize
535KB
MD56182064d4904132d202f896f5f5d5af7
SHA135749f39a01116ef20b90c5e5e468bd762b9a3ca
SHA25604c823b043fb65a81c8d61b9cfe0c3e0e113acc658667ce22634310426864642
SHA5125c34249e68feb93643e07e8892442fff6f47efa96a7677e3348062e6e49573b8219a01ddf2b058e14e47c3b8aecdc073ff6da1804f3168b35548c06223bb2aca
-
Filesize
535KB
MD5514b70b047f6742100e60cb3b1590890
SHA1193bfeb59c21646d70e4f1d846045e8e992cd8c7
SHA25698d5eeff1c38c63759245951f1f2a78ee72e2a1e61c127a152045329d640a80a
SHA512ff3e53b4f647422d94d1197bbd325d0144b66e49f49283093cb5a0d6e03ea6df346929f059ac04dd6c298189bfe52becc92f979ed20c42822acb1b13943f05ad
-
Filesize
535KB
MD52f914262275675a90612254287c9f023
SHA16359e82a009d3c19c42bd765e297a90a099a238e
SHA256ecce059cb24aab0cb9016d9159319bb3ca3bf1b7e6f4ac3a613bbfd302243c79
SHA5123309846027d0361076b6da25e965c3621c777c0e3886ac50a48cd8f3babec9c659c9cd616b5cb1d68f1bf8ef1d023bc14b656b31b077b6b6be81ba8141d3f308
-
Filesize
535KB
MD544414762c28f66521ff4ce7e4f0d19ea
SHA1942d55d871cfaa98c6d2b3032d507360b8219f3b
SHA256a3bdb9f6f31399ec64e669086851c7ced99084dca4d3e872d50b9008b39c0a8f
SHA512a63045026479eac4a2f92f890665d147fb8defb67ffc7c14490db2dae393863cb6deea77e2fa3e9d1e69cb764f1566c6de80ca3d6a62466979cec6e582a1fc0e
-
Filesize
535KB
MD58d24f1bc896e64df9ba3b23d687fdbdd
SHA1d4347c8af923efd9dd2144a0375d2dffaeccec88
SHA2567a1b2c5ecf3c6805465479eb45a7af1169f1e299c95de9f324e3f4e601357626
SHA512c365591eb1c30e8e58191e83ba884b0be779d2a3e48451e62999b640f06f6ccbde3741f414e14f3a096a2086d3885f393aa61e4df40665e3038723ea245078ea
-
Filesize
535KB
MD5f77695056373424d6350fab84641204d
SHA17a05d83369c1a43db26c084729ac9b42c50dfe65
SHA2568bfdf90cf692f78994374828e6af5e7fd1e84632732937b777390f00fc6cbd0b
SHA512dd4bddf339ab6f0fe644abd082e953143464dc4f37044069efe0d54bf98e35b3d24ccb5919f1bc2cd61bb1a75e4b5c77aa99afbd874c2a97d2c3bde896aa53d9
-
Filesize
535KB
MD5d5b7c531c05dea76d90af53ab14f9a32
SHA110a6744308b2cb35f4ba6d2cadf0f518624f50ac
SHA25697204589accc527fb8ddf201ef07fa7e71af441821b2fee251429589045a3828
SHA512ae19b73ee042bea1836e13e8a276230d7fde23a7ef662b70a3b50334fd91ba08b5d59a917e87435d4a6d6b618bec0e6956f622a2eb7e6b1d85d1a92795ac8724
-
Filesize
535KB
MD52affd72b6043a3f36d82d9245ccf3517
SHA14b0231f092dc033b896a6ccacd01a1b006450783
SHA256c3f915c20b3288073e8757a57a18da95add34624e5ad675b62f48601c49d95ad
SHA51299f687f2df4798e15cd4d63e5cf1d5bee80f2bc7a73da4a0a63766b478a3644eb53329c0a24ffc18376e63d09e5ecb9b9dfec7314cbad848151cdc7d9e32064c
-
Filesize
535KB
MD5aceb919fb51bd9f35728baf8df111d10
SHA11c5478e8e76eec24ba45d7e3f7696cb44047912c
SHA256d537df8b8c5a3311ca75681cf901108c3f31228bd58932278feefea7bcd145f3
SHA5122e8dee04d82492e315467a7339d75c684d6b28af6ab6c9bdd1af6ba203421ba7f8cc64440297b94578cd32371e3e47d2305eddaa8d0398c14588fc5fc25d49e9
-
Filesize
535KB
MD534e648bc3f57b2f5b22cf7194e5dffb2
SHA144e7dac5b9b02e6375fa052f81630b83ec9efe0c
SHA256eed425a6f39ef606d094646802e2fcdaf2f0eae4c35c1ce75d814879e33c5016
SHA512135df1f83b9e7600db9ed39b690096ac7f63cc3d2d504a0f61e10657e0af27e205a1528af9dae729dd13e5879e1b0003782fec01f68a37d9d27f9b6cd7341039
-
Filesize
535KB
MD5612f2688db8091e3d3cba6e3e49faa32
SHA1b6109442295c0113813541bd6fa6c1a9f89a9f81
SHA25686e1697603be6fda3f01b976e320d3965e3252631b0798ae24bdcc555d1f36b7
SHA512bd0e083b05b6f418c922e5308a20aeb69194c0655e1354b698b1fdabab5fcca3a2d5e279680b4ca1dc476f869765e1c62f722e54cae395baad86dbcc8f9ce81a