Extracted

• • Target

    libudev.so

  • Size

    542KB

  • MD5

    b51476351c030b45c982011e12be17d7

  • SHA1

    9db5baba5f06bc3e6d5b78de1505eee915690148

  • SHA256

    6ddf688bdf16a1d465aef954ff90b372dacd8162bac2c7797ff7b6b4f20afcbc

  • SHA512

    6ee3c1cef54bf515ac07e6e0d2932e3eabe86dac80f546befff8d8a1f4de22b6dd95e91580306361dbc7af11bcfed6d421f739bc9b37e38665ef342007b0efe7

  • SSDEEP

    12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXhLLp6yWrk3:VB2WCH/eMU9Uc8gd49N94BJXhLL4ru

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalationstealer

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Executes dropped EXE

  • Reads EFI boot settings

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    stealer

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1behavioral2