Extracted

• • Target

    mdmnpygceatyeq

  • Size

    544KB

  • MD5

    f44ae424e83e10004380f6aadceebb15

  • SHA1

    173c9062c3326d4940cf7b6cc70c1a750dda2a49

  • SHA256

    a89c8ef292c00472850398e72e2bfa6beb9e5e460d52863faf6cefa7c6d723f5

  • SHA512

    e05aca5a978932c4b842e04d77c717e88a82fae00e99edb7ed7c2569fbdc9b1dc70a812c21b386f3ee1535a799296e6ecbcda15d0a5e9e73afcfcff6c47bd326

  • SSDEEP

    12288:JbinNy0Y1nvEtXBx6DkkJmAGyPexU279WnjVZ6ySWKZ:1iNy0evmxvkJmApPexUm9cVEb

  Score

  10^/10

  xorddosbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalation

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Deletes itself

  • Executes dropped EXE

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Writes file to system bin folder

  behavioral1