Extracted

• • Target

    yqvqgxlwdm

  • Size

    542KB

  • MD5

    254c179e8b70de2b64993aa4375d3dc1

  • SHA1

    bebd4f6d3898af3d09fa694d9d5f22cdca40b656

  • SHA256

    e653a91c04d3c29165f96e463d656932130a490a607990054afb3f286720019b

  • SHA512

    e03db5c834c34e6a20b1ece9dddf9abd5a0d5a96b8d65c8219ae6f96b744f1a9c5791eb5e9b2e56c0b212a3fc755c2eef179708bb05f9db040ba362d87e204ad

  • SSDEEP

    12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXhLLp6yWrk3G:VB2WCH/eMU9Uc8gd49N94BJXhLL4ruG

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalationstealer

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    stealer

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1