xorddos | ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
30/03/2025, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73
Size

549KB
MD5

f9191bab1e834d4aef3380700639cee9
SHA1

9c20269df6694260a24ac783de2e30d627a6928a
SHA256

ea40ecec0b30982fbb1662e67f97f0e9d6f43d2d587f2f588525fae683abea73
SHA512

3d2758fe2d06183e627b5cc24919c08c84108f2efd7ab0a162029d55537476410d9535d50f3eb059f7153f7482c134284862eea121201f82838aace4b12283b5
SSDEEP

12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO

Score

10^/10

xorddos botnet discovery downloader execution persistence privilege_escalation

Malware Config

Extracted

Family

xorddos

api.markerbio.com:112

api.enoan2107.com:112

http://qq.com/lib.asp

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_xorddos

Xorddos family
xorddos

Deletes itself 64 IoCs

pid	Process
1563	Process not Found
1572	sfegba
1577	rdtoimjocmox
1578	fzwfmpziiqt
1581	uvcfmrmnptz
1584	jpkdadiv
1594	ikhzdggxqvj
1595	dhlrvknrfpy
1598	xndshwbmdmd
1603	ytsdiqxtdguima
1604	exrbueho
1607	kwgfzmahacpf
1610	hiwnplbv
1615	egglrhlxqwvwd
1616	iddlgvsica
1619	psrsnwxv
1624	tjozyittxpsst
1625	jdkwlf
1629	jeawiwhjwn
1631	bxqmeehnug
1634	dzhaqzvjdeogc
1637	xwqudezenbvm
1640	gscwyh
1643	cscdtggsz
1646	xzunvzuughv
1649	wujoygmf
1652	oaftvnanpymo
1655	ajuwfad
1658	dbuopvudaxucf
1663	ngdolfkzufwai
1664	yspnhpaxkcie
1667	cyakeyymdo
1670	iazfivfq
1674	bcrknkjlo
1676	lqyldflbro
1679	rzrqebllt
1686	ddnxgbv
1687	liwqphrjxiawcs
1692	yghigcqpqalg
1693	uazrkzqmru
1696	wirejmhjupt
1699	rccjpvejroax
1702	oflkwem
1705	qfzajrcjjfcl
1708	mccslvgnsfdz
1711	nxxbnngmppdty
1717	ydzfpchjn
1716	pdywgapwxox
1720	bewqvbjuph
1723	poorxzg
1726	qjbmsbdozrl
1729	ssylrxrsnd
1732	bvxfjwy
1735	itosdbdzmg
1738	uywslppdieie
1741	dbmoalmi
1744	mdabudl
1747	nrgqvugvhsfn
1750	hxaohscxdrjj
1753	lfuyghqozlih
1756	qzndwwcxkkrn
1761	uhbfpinh
1762	clgynfjz
1765	yhscaazglq

Executes dropped EXE 64 IoCs

ioc	pid	Process
/usr/bin/tabupw	1566	Process not Found
/usr/bin/sfegba	1571	tabupw
/usr/bin/rdtoimjocmox	1576	tabupw
/usr/bin/fzwfmpziiqt	1574	tabupw
/usr/bin/uvcfmrmnptz	1580	tabupw
/usr/bin/jpkdadiv	1583	tabupw
/usr/bin/ikhzdggxqvj	1593	tabupw
/usr/bin/dhlrvknrfpy	1591	tabupw
/usr/bin/xndshwbmdmd	1597	tabupw
/usr/bin/ytsdiqxtdguima	1600	tabupw
/usr/bin/exrbueho	1602	tabupw
/usr/bin/kwgfzmahacpf	1606	tabupw
/usr/bin/hiwnplbv	1609	tabupw
/usr/bin/egglrhlxqwvwd	1612	tabupw
/usr/bin/iddlgvsica	1614	tabupw
/usr/bin/psrsnwxv	1618	tabupw
/usr/bin/jdkwlf	1621	tabupw
/usr/bin/tjozyittxpsst	1623	tabupw
/usr/bin/jeawiwhjwn	1627	tabupw
/usr/bin/bxqmeehnug	1630	tabupw
/usr/bin/dzhaqzvjdeogc	1633	tabupw
/usr/bin/xwqudezenbvm	1636	tabupw
/usr/bin/gscwyh	1639	tabupw
/usr/bin/cscdtggsz	1642	tabupw
/usr/bin/xzunvzuughv	1645	tabupw
/usr/bin/wujoygmf	1648	tabupw
/usr/bin/oaftvnanpymo	1651	tabupw
/usr/bin/ajuwfad	1654	tabupw
/usr/bin/dbuopvudaxucf	1657	tabupw
/usr/bin/ngdolfkzufwai	1662	tabupw
/usr/bin/yspnhpaxkcie	1660	tabupw
/usr/bin/cyakeyymdo	1666	tabupw
/usr/bin/iazfivfq	1669	tabupw
/usr/bin/bcrknkjlo	1672	tabupw
/usr/bin/lqyldflbro	1675	tabupw
/usr/bin/rzrqebllt	1678	tabupw
/usr/bin/ddnxgbv	1685	tabupw
/usr/bin/liwqphrjxiawcs	1683	tabupw
/usr/bin/yghigcqpqalg	1689	tabupw
/usr/bin/uazrkzqmru	1691	tabupw
/usr/bin/wirejmhjupt	1695	tabupw
/usr/bin/rccjpvejroax	1698	tabupw
/usr/bin/oflkwem	1701	tabupw
/usr/bin/qfzajrcjjfcl	1704	tabupw
/usr/bin/mccslvgnsfdz	1707	tabupw
/usr/bin/nxxbnngmppdty	1710	tabupw
/usr/bin/pdywgapwxox	1715	tabupw
/usr/bin/ydzfpchjn	1713	tabupw
/usr/bin/bewqvbjuph	1719	tabupw
/usr/bin/poorxzg	1722	tabupw
/usr/bin/qjbmsbdozrl	1725	tabupw
/usr/bin/ssylrxrsnd	1728	tabupw
/usr/bin/bvxfjwy	1731	tabupw
/usr/bin/itosdbdzmg	1734	tabupw
/usr/bin/uywslppdieie	1737	tabupw
/usr/bin/dbmoalmi	1740	tabupw
/usr/bin/mdabudl	1743	tabupw
/usr/bin/nrgqvugvhsfn	1746	tabupw
/usr/bin/hxaohscxdrjj	1749	tabupw
/usr/bin/lfuyghqozlih	1752	tabupw
/usr/bin/qzndwwcxkkrn	1755	tabupw
/usr/bin/uhbfpinh	1758	tabupw
/usr/bin/clgynfjz	1760	tabupw
/usr/bin/yhscaazglq	1764	tabupw

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.hourly/wpubat.sh	tabupw

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	tabupw

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/wpubat	tabupw

Write file to user bin folder 64 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/qntodyw	tabupw
File opened for modification	/usr/bin/tabupw	Process not Found
File opened for modification	/usr/bin/egglrhlxqwvwd	tabupw
File opened for modification	/usr/bin/jdkwlf	tabupw
File opened for modification	/usr/bin/xkumslj	tabupw
File opened for modification	/usr/bin/txqtkwqaw	tabupw
File opened for modification	/usr/bin/pmkvaosnf	tabupw
File opened for modification	/usr/bin/qcjvamop	tabupw
File opened for modification	/usr/bin/wujoygmf	tabupw
File opened for modification	/usr/bin/kwgfzmahacpf	tabupw
File opened for modification	/usr/bin/ajuwfad	tabupw
File opened for modification	/usr/bin/dbmoalmi	tabupw
File opened for modification	/usr/bin/uhbfpinh	tabupw
File opened for modification	/usr/bin/dkzokv	tabupw
File opened for modification	/usr/bin/shyvjihnf	tabupw
File opened for modification	/usr/bin/uzrffrjj	tabupw
File opened for modification	/usr/bin/xndshwbmdmd	tabupw
File opened for modification	/usr/bin/ngdolfkzufwai	tabupw
File opened for modification	/usr/bin/qaxekk	tabupw
File opened for modification	/usr/bin/utqjusgvynedaz	tabupw
File opened for modification	/usr/bin/unorxkdrvonx	tabupw
File opened for modification	/usr/bin/jsedmwpiovdpk	tabupw
File opened for modification	/usr/bin/annwepkymp	tabupw
File opened for modification	/usr/bin/iazfivfq	tabupw
File opened for modification	/usr/bin/azhpqiqglkve	tabupw
File opened for modification	/usr/bin/nqktighxfp	tabupw
File opened for modification	/usr/bin/tjozyittxpsst	tabupw
File opened for modification	/usr/bin/cyakeyymdo	tabupw
File opened for modification	/usr/bin/uhxucaqkrcssdn	tabupw
File opened for modification	/usr/bin/quldwlxxcm	tabupw
File opened for modification	/usr/bin/zjknqpjloy	tabupw
File opened for modification	/usr/bin/ycgdvxv	tabupw
File opened for modification	/usr/bin/kapjapk	tabupw
File opened for modification	/usr/bin/ssylrxrsnd	tabupw
File opened for modification	/usr/bin/aedkpix	tabupw
File opened for modification	/usr/bin/wpubat.sh	tabupw
File opened for modification	/usr/bin/lqyldflbro	tabupw
File opened for modification	/usr/bin/mccslvgnsfdz	tabupw
File opened for modification	/usr/bin/ljydjvnc	tabupw
File opened for modification	/usr/bin/gxqplimrghx	tabupw
File opened for modification	/usr/bin/clgynfjz	tabupw
File opened for modification	/usr/bin/ruktcinkhcsy	tabupw
File opened for modification	/usr/bin/owjewecrlzmqv	tabupw
File opened for modification	/usr/bin/vvegtqxglx	tabupw
File opened for modification	/usr/bin/grathsruwhj	tabupw
File opened for modification	/usr/bin/xwqudezenbvm	tabupw
File opened for modification	/usr/bin/liwqphrjxiawcs	tabupw
File opened for modification	/usr/bin/ddnxgbv	tabupw
File opened for modification	/usr/bin/gynqzfa	tabupw
File opened for modification	/usr/bin/lqylyarwqjxvli	tabupw
File opened for modification	/usr/bin/rdtoimjocmox	tabupw
File opened for modification	/usr/bin/lfuyghqozlih	tabupw
File opened for modification	/usr/bin/uzekur	tabupw
File opened for modification	/usr/bin/sfotbakahl	tabupw
File opened for modification	/usr/bin/dhlrvknrfpy	tabupw
File opened for modification	/usr/bin/mdabudl	tabupw
File opened for modification	/usr/bin/hlxqcjxjhxcjx	tabupw
File opened for modification	/usr/bin/atgugr	tabupw
File opened for modification	/usr/bin/dyyqfjgm	tabupw
File opened for modification	/usr/bin/eihkmgapxqpa	tabupw
File opened for modification	/usr/bin/sawokgmg	tabupw
File opened for modification	/usr/bin/uvcfmrmnptz	tabupw
File opened for modification	/usr/bin/yspnhpaxkcie	tabupw
File opened for modification	/usr/bin/doulzeidtrw	tabupw

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	tabupw

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/918/fd	tabupw
File opened for reading	/proc/1122/fd	tabupw
File opened for reading	/proc/1214/fd	tabupw
File opened for reading	/proc/1307/fd	tabupw
File opened for reading	/proc/1908/fd	tabupw
File opened for reading	/proc/1951/fd	tabupw
File opened for reading	/proc/1963/fd	tabupw
File opened for reading	/proc/1987/fd	tabupw
File opened for reading	/proc/1330/fd	tabupw
File opened for reading	/proc/1449/fd	tabupw
File opened for reading	/proc/377/fd	tabupw
File opened for reading	/proc/593/fd	tabupw
File opened for reading	/proc/1032/fd	tabupw
File opened for reading	/proc/1219/fd	tabupw
File opened for reading	/proc/1903/fd	tabupw
File opened for reading	/proc/1999/fd	tabupw
File opened for reading	/proc/987/fd	tabupw
File opened for reading	/proc/1008/fd	tabupw
File opened for reading	/proc/634/fd	tabupw
File opened for reading	/proc/782/fd	tabupw
File opened for reading	/proc/1087/fd	tabupw
File opened for reading	/proc/1867/fd	tabupw
File opened for reading	/proc/1893/fd	tabupw
File opened for reading	/proc/2005/fd	tabupw
File opened for reading	/proc/1990/fd	tabupw
File opened for reading	/proc/2047/fd	tabupw
File opened for reading	/proc/2074/fd	tabupw
File opened for reading	/proc/2080/fd	tabupw
File opened for reading	/proc/522/fd	tabupw
File opened for reading	/proc/587/fd	tabupw
File opened for reading	/proc/774/fd	tabupw
File opened for reading	/proc/787/fd	tabupw
File opened for reading	/proc/967/fd	tabupw
File opened for reading	/proc/1009/fd	tabupw
File opened for reading	/proc/1112/fd	tabupw
File opened for reading	/proc/1792/fd	tabupw
File opened for reading	/proc/698/fd	tabupw
File opened for reading	/proc/926/fd	tabupw
File opened for reading	/proc/1111/fd	tabupw
File opened for reading	/proc/1374/fd	tabupw
File opened for reading	/proc/1804/fd	tabupw
File opened for reading	/proc/1828/fd	tabupw
File opened for reading	/proc/1900/fd	tabupw
File opened for reading	/proc/1927/fd	tabupw
File opened for reading	/proc/417/fd	tabupw
File opened for reading	/proc/592/fd	tabupw
File opened for reading	/proc/789/fd	tabupw
File opened for reading	/proc/1028/fd	tabupw
File opened for reading	/proc/1106/fd	tabupw
File opened for reading	/proc/1351/fd	tabupw
File opened for reading	/proc/1780/fd	tabupw
File opened for reading	/proc/1957/fd	tabupw
File opened for reading	/proc/meminfo	tabupw
File opened for reading	/proc/763/fd	tabupw
File opened for reading	/proc/1020/fd	tabupw
File opened for reading	/proc/1022/fd	tabupw
File opened for reading	/proc/1849/fd	tabupw
File opened for reading	/proc/1879/fd	tabupw
File opened for reading	/proc/1993/fd	tabupw
File opened for reading	/proc/2020/fd	tabupw
File opened for reading	/proc/609/fd	tabupw
File opened for reading	/proc/735/fd	tabupw
File opened for reading	/proc/798/fd	tabupw
File opened for reading	/proc/1104/fd	tabupw

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/sem.kujxvn	tabupw
File opened for modification	/dev/shm/sem.0t8psl	tabupw

/usr/bin/tabupw
/usr/bin/tabupw
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Modifies init.d
- Write file to user bin folder
- Reads system network configuration
- Reads runtime system information
- Writes file to shm directory
PID:1566

/usr/bin/sfegba
/usr/bin/sfegba -d 1567
1⤵
- Deletes itself
PID:1571

/usr/bin/rdtoimjocmox
/usr/bin/rdtoimjocmox -d 1567
1⤵
- Deletes itself
PID:1576

/usr/bin/fzwfmpziiqt
/usr/bin/fzwfmpziiqt -d 1567
1⤵
- Deletes itself
PID:1574

/usr/bin/uvcfmrmnptz
/usr/bin/uvcfmrmnptz -d 1567
1⤵
- Deletes itself
PID:1580

/usr/bin/jpkdadiv
/usr/bin/jpkdadiv -d 1567
1⤵
- Deletes itself
PID:1583

/usr/bin/ikhzdggxqvj
/usr/bin/ikhzdggxqvj -d 1567
1⤵
- Deletes itself
PID:1593

/usr/bin/dhlrvknrfpy
/usr/bin/dhlrvknrfpy -d 1567
1⤵
- Deletes itself
PID:1591

/usr/bin/xndshwbmdmd
/usr/bin/xndshwbmdmd -d 1567
1⤵
- Deletes itself
PID:1597

/usr/bin/ytsdiqxtdguima
/usr/bin/ytsdiqxtdguima -d 1567
1⤵
- Deletes itself
PID:1600

/usr/bin/exrbueho
/usr/bin/exrbueho -d 1567
1⤵
- Deletes itself
PID:1602

/usr/bin/kwgfzmahacpf
/usr/bin/kwgfzmahacpf -d 1567
1⤵
- Deletes itself
PID:1606

/usr/bin/hiwnplbv
/usr/bin/hiwnplbv -d 1567
1⤵
- Deletes itself
PID:1609

/usr/bin/egglrhlxqwvwd
/usr/bin/egglrhlxqwvwd -d 1567
1⤵
- Deletes itself
PID:1612

/usr/bin/iddlgvsica
/usr/bin/iddlgvsica -d 1567
1⤵
- Deletes itself
PID:1614

/usr/bin/psrsnwxv
/usr/bin/psrsnwxv -d 1567
1⤵
- Deletes itself
PID:1618

/usr/bin/tjozyittxpsst
/usr/bin/tjozyittxpsst -d 1567
1⤵
- Deletes itself
PID:1623

/usr/bin/jdkwlf
/usr/bin/jdkwlf -d 1567
1⤵
- Deletes itself
PID:1621

/usr/bin/jeawiwhjwn
/usr/bin/jeawiwhjwn -d 1567
1⤵
- Deletes itself
PID:1627

/usr/bin/bxqmeehnug
/usr/bin/bxqmeehnug -d 1567
1⤵
- Deletes itself
PID:1630

/usr/bin/dzhaqzvjdeogc
/usr/bin/dzhaqzvjdeogc -d 1567
1⤵
- Deletes itself
PID:1633

/usr/bin/xwqudezenbvm
/usr/bin/xwqudezenbvm -d 1567
1⤵
- Deletes itself
PID:1636

/usr/bin/gscwyh
/usr/bin/gscwyh -d 1567
1⤵
- Deletes itself
PID:1639

/usr/bin/cscdtggsz
/usr/bin/cscdtggsz -d 1567
1⤵
- Deletes itself
PID:1642

/usr/bin/xzunvzuughv
/usr/bin/xzunvzuughv -d 1567
1⤵
- Deletes itself
PID:1645

/usr/bin/wujoygmf
/usr/bin/wujoygmf -d 1567
1⤵
- Deletes itself
PID:1648

/usr/bin/oaftvnanpymo
/usr/bin/oaftvnanpymo -d 1567
1⤵
- Deletes itself
PID:1651

/usr/bin/ajuwfad
/usr/bin/ajuwfad -d 1567
1⤵
- Deletes itself
PID:1654

/usr/bin/dbuopvudaxucf
/usr/bin/dbuopvudaxucf -d 1567
1⤵
- Deletes itself
PID:1657

/usr/bin/ngdolfkzufwai
/usr/bin/ngdolfkzufwai -d 1567
1⤵
- Deletes itself
PID:1662

/usr/bin/yspnhpaxkcie
/usr/bin/yspnhpaxkcie -d 1567
1⤵
- Deletes itself
PID:1660

/usr/bin/cyakeyymdo
/usr/bin/cyakeyymdo -d 1567
1⤵
- Deletes itself
PID:1666

/usr/bin/iazfivfq
/usr/bin/iazfivfq -d 1567
1⤵
- Deletes itself
PID:1669

/usr/bin/bcrknkjlo
/usr/bin/bcrknkjlo -d 1567
1⤵
- Deletes itself
PID:1672

/usr/bin/lqyldflbro
/usr/bin/lqyldflbro -d 1567
1⤵
- Deletes itself
PID:1675

/usr/bin/rzrqebllt
/usr/bin/rzrqebllt -d 1567
1⤵
- Deletes itself
PID:1678

/usr/bin/ddnxgbv
/usr/bin/ddnxgbv -d 1567
1⤵
- Deletes itself
PID:1685

/usr/bin/liwqphrjxiawcs
/usr/bin/liwqphrjxiawcs -d 1567
1⤵
- Deletes itself
PID:1683

/usr/bin/yghigcqpqalg
/usr/bin/yghigcqpqalg -d 1567
1⤵
- Deletes itself
PID:1689

/usr/bin/uazrkzqmru
/usr/bin/uazrkzqmru -d 1567
1⤵
- Deletes itself
PID:1691

/usr/bin/wirejmhjupt
/usr/bin/wirejmhjupt -d 1567
1⤵
- Deletes itself
PID:1695

/usr/bin/rccjpvejroax
/usr/bin/rccjpvejroax -d 1567
1⤵
- Deletes itself
PID:1698

/usr/bin/oflkwem
/usr/bin/oflkwem -d 1567
1⤵
- Deletes itself
PID:1701

/usr/bin/qfzajrcjjfcl
/usr/bin/qfzajrcjjfcl -d 1567
1⤵
- Deletes itself
PID:1704

/usr/bin/mccslvgnsfdz
/usr/bin/mccslvgnsfdz -d 1567
1⤵
- Deletes itself
PID:1707

/usr/bin/nxxbnngmppdty
/usr/bin/nxxbnngmppdty -d 1567
1⤵
- Deletes itself
PID:1710

/usr/bin/pdywgapwxox
/usr/bin/pdywgapwxox -d 1567
1⤵
- Deletes itself
PID:1715

/usr/bin/ydzfpchjn
/usr/bin/ydzfpchjn -d 1567
1⤵
- Deletes itself
PID:1713

/usr/bin/bewqvbjuph
/usr/bin/bewqvbjuph -d 1567
1⤵
- Deletes itself
PID:1719

/usr/bin/poorxzg
/usr/bin/poorxzg -d 1567
1⤵
- Deletes itself
PID:1722

/usr/bin/qjbmsbdozrl
/usr/bin/qjbmsbdozrl -d 1567
1⤵
- Deletes itself
PID:1725

/usr/bin/ssylrxrsnd
/usr/bin/ssylrxrsnd -d 1567
1⤵
- Deletes itself
PID:1728

/usr/bin/bvxfjwy
/usr/bin/bvxfjwy -d 1567
1⤵
- Deletes itself
PID:1731

/usr/bin/itosdbdzmg
/usr/bin/itosdbdzmg -d 1567
1⤵
- Deletes itself
PID:1734

/usr/bin/uywslppdieie
/usr/bin/uywslppdieie -d 1567
1⤵
- Deletes itself
PID:1737

/usr/bin/dbmoalmi
/usr/bin/dbmoalmi -d 1567
1⤵
- Deletes itself
PID:1740

/usr/bin/mdabudl
/usr/bin/mdabudl -d 1567
1⤵
- Deletes itself
PID:1743

/usr/bin/nrgqvugvhsfn
/usr/bin/nrgqvugvhsfn -d 1567
1⤵
- Deletes itself
PID:1746

/usr/bin/hxaohscxdrjj
/usr/bin/hxaohscxdrjj -d 1567
1⤵
- Deletes itself
PID:1749

/usr/bin/lfuyghqozlih
/usr/bin/lfuyghqozlih -d 1567
1⤵
- Deletes itself
PID:1752

/usr/bin/qzndwwcxkkrn
/usr/bin/qzndwwcxkkrn -d 1567
1⤵
- Deletes itself
PID:1755

/usr/bin/uhbfpinh
/usr/bin/uhbfpinh -d 1567
1⤵
- Deletes itself
PID:1758

/usr/bin/clgynfjz
/usr/bin/clgynfjz -d 1567
1⤵
- Deletes itself
PID:1760

/usr/bin/yhscaazglq
/usr/bin/yhscaazglq -d 1567
1⤵
- Deletes itself
PID:1764

/usr/bin/esfltmcbakmev
/usr/bin/esfltmcbakmev -d 1567
1⤵
PID:1767

/usr/bin/dkzokv
/usr/bin/dkzokv -d 1567
1⤵
PID:1770

/usr/bin/tqqvqpddhnjzu
/usr/bin/tqqvqpddhnjzu -d 1567
1⤵
PID:1779

/usr/bin/shyvjihnf
/usr/bin/shyvjihnf -d 1567
1⤵
PID:1782

/usr/bin/ssbgezu
/usr/bin/ssbgezu -d 1567
1⤵
PID:1785

/usr/bin/rkujbxmik
/usr/bin/rkujbxmik -d 1567
1⤵
PID:1788

/usr/bin/jhtdoryzcio
/usr/bin/jhtdoryzcio -d 1567
1⤵
PID:1791

/usr/bin/mhdpphqmghy
/usr/bin/mhdpphqmghy -d 1567
1⤵
PID:1794

/usr/bin/qaxekk
/usr/bin/qaxekk -d 1567
1⤵
PID:1797

/usr/bin/urwxhqyiuiwdu
/usr/bin/urwxhqyiuiwdu -d 1567
1⤵
PID:1800

/usr/bin/hlxqcjxjhxcjx
/usr/bin/hlxqcjxjhxcjx -d 1567
1⤵
PID:1803

/usr/bin/ujmqck
/usr/bin/ujmqck -d 1567
1⤵
PID:1806

/usr/bin/lantuvrarx
/usr/bin/lantuvrarx -d 1567
1⤵
PID:1809

/usr/bin/duzffyqoysavdu
/usr/bin/duzffyqoysavdu -d 1567
1⤵
PID:1812

/usr/bin/pmizbtcpmwkdy
/usr/bin/pmizbtcpmwkdy -d 1567
1⤵
PID:1815

/usr/bin/chhyjmdh
/usr/bin/chhyjmdh -d 1567
1⤵
PID:1818

/usr/bin/uhxucaqkrcssdn
/usr/bin/uhxucaqkrcssdn -d 1567
1⤵
PID:1821

/usr/bin/uzrffrjj
/usr/bin/uzrffrjj -d 1567
1⤵
PID:1824

/usr/bin/qikenti
/usr/bin/qikenti -d 1567
1⤵
PID:1827

/usr/bin/bfdfhtq
/usr/bin/bfdfhtq -d 1567
1⤵
PID:1830

/usr/bin/xktdynxzg
/usr/bin/xktdynxzg -d 1567
1⤵
PID:1833

/usr/bin/gynqzfa
/usr/bin/gynqzfa -d 1567
1⤵
PID:1836

/usr/bin/jpeszfz
/usr/bin/jpeszfz -d 1567
1⤵
PID:1839

/usr/bin/ljydjvnc
/usr/bin/ljydjvnc -d 1567
1⤵
PID:1842

/usr/bin/lqylyarwqjxvli
/usr/bin/lqylyarwqjxvli -d 1567
1⤵
PID:1845

/usr/bin/bnzauaehjekva
/usr/bin/bnzauaehjekva -d 1567
1⤵
PID:1848

/usr/bin/xanpyaqbumtdmo
/usr/bin/xanpyaqbumtdmo -d 1567
1⤵
PID:1851

/usr/bin/utqjusgvynedaz
/usr/bin/utqjusgvynedaz -d 1567
1⤵
PID:1854

/usr/bin/azhpqiqglkve
/usr/bin/azhpqiqglkve -d 1567
1⤵
PID:1857

/usr/bin/jsedmwpiovdpk
/usr/bin/jsedmwpiovdpk -d 1567
1⤵
PID:1860

/usr/bin/sklxmke
/usr/bin/sklxmke -d 1567
1⤵
PID:1862

/usr/bin/doulzeidtrw
/usr/bin/doulzeidtrw -d 1567
1⤵
PID:1866

/usr/bin/xkumslj
/usr/bin/xkumslj -d 1567
1⤵
PID:1869

/usr/bin/atgugr
/usr/bin/atgugr -d 1567
1⤵
PID:1872

/usr/bin/sexwhoqunudr
/usr/bin/sexwhoqunudr -d 1567
1⤵
PID:1875

/usr/bin/unorxkdrvonx
/usr/bin/unorxkdrvonx -d 1567
1⤵
PID:1878

/usr/bin/vronkitkhayxw
/usr/bin/vronkitkhayxw -d 1567
1⤵
PID:1881

/usr/bin/uzekur
/usr/bin/uzekur -d 1567
1⤵
PID:1884

/usr/bin/nqktighxfp
/usr/bin/nqktighxfp -d 1567
1⤵
PID:1887

/usr/bin/hqzlcvfcixnbh
/usr/bin/hqzlcvfcixnbh -d 1567
1⤵
PID:1892

/usr/bin/xfijqbtxdtw
/usr/bin/xfijqbtxdtw -d 1567
1⤵
PID:1890

/usr/bin/jfaaazikjylexo
/usr/bin/jfaaazikjylexo -d 1567
1⤵
PID:1896

/usr/bin/tphmqsqlzt
/usr/bin/tphmqsqlzt -d 1567
1⤵
PID:1899

/usr/bin/xixefilfln
/usr/bin/xixefilfln -d 1567
1⤵
PID:1902

/usr/bin/txqtkwqaw
/usr/bin/txqtkwqaw -d 1567
1⤵
PID:1905

/usr/bin/qdxgyouzjqwr
/usr/bin/qdxgyouzjqwr -d 1567
1⤵
PID:1907

/usr/bin/dyyqfjgm
/usr/bin/dyyqfjgm -d 1567
1⤵
PID:1911

/usr/bin/dezqbp
/usr/bin/dezqbp -d 1567
1⤵
PID:1914

/usr/bin/zaifapdole
/usr/bin/zaifapdole -d 1567
1⤵
PID:1917

/usr/bin/bbqsgoqyt
/usr/bin/bbqsgoqyt -d 1567
1⤵
PID:1920

/usr/bin/eihkmgapxqpa
/usr/bin/eihkmgapxqpa -d 1567
1⤵
PID:1923

/usr/bin/uaqzqddnggf
/usr/bin/uaqzqddnggf -d 1567
1⤵
PID:1926

/usr/bin/ovpnqstyadlifc
/usr/bin/ovpnqstyadlifc -d 1567
1⤵
PID:1929

/usr/bin/yrgzniroyusna
/usr/bin/yrgzniroyusna -d 1567
1⤵
PID:1932

/usr/bin/sypnpefkzem
/usr/bin/sypnpefkzem -d 1567
1⤵
PID:1935

/usr/bin/ruktcinkhcsy
/usr/bin/ruktcinkhcsy -d 1567
1⤵
PID:1938

/usr/bin/quldwlxxcm
/usr/bin/quldwlxxcm -d 1567
1⤵
PID:1941

/usr/bin/isyiwknphxkji
/usr/bin/isyiwknphxkji -d 1567
1⤵
PID:1944

/usr/bin/urcmsvf
/usr/bin/urcmsvf -d 1567
1⤵
PID:1947

/usr/bin/gkjtiiyu
/usr/bin/gkjtiiyu -d 1567
1⤵
PID:1950

/usr/bin/iovqmhfbof
/usr/bin/iovqmhfbof -d 1567
1⤵
PID:1953

/usr/bin/annwepkymp
/usr/bin/annwepkymp -d 1567
1⤵
PID:1956

/usr/bin/sawokgmg
/usr/bin/sawokgmg -d 1567
1⤵
PID:1959

/usr/bin/wvznhhulxzzzo
/usr/bin/wvznhhulxzzzo -d 1567
1⤵
PID:1962

/usr/bin/vvegtqxglx
/usr/bin/vvegtqxglx -d 1567
1⤵
PID:1965

/usr/bin/zjknqpjloy
/usr/bin/zjknqpjloy -d 1567
1⤵
PID:1968

/usr/bin/xtfvuewjrsgxy
/usr/bin/xtfvuewjrsgxy -d 1567
1⤵
PID:1971

/usr/bin/nviyvoxgzm
/usr/bin/nviyvoxgzm -d 1567
1⤵
PID:1977

/usr/bin/owjewecrlzmqv
/usr/bin/owjewecrlzmqv -d 1567
1⤵
PID:1980

/usr/bin/jndgnevlougdto
/usr/bin/jndgnevlougdto -d 1567
1⤵
PID:1983

/usr/bin/ilsgwyc
/usr/bin/ilsgwyc -d 1567
1⤵
PID:1986

/usr/bin/aumbgex
/usr/bin/aumbgex -d 1567
1⤵
PID:1989

/usr/bin/pmkvaosnf
/usr/bin/pmkvaosnf -d 1567
1⤵
PID:1992

/usr/bin/viijmqwgwt
/usr/bin/viijmqwgwt -d 1567
1⤵
PID:1995

/usr/bin/athuhic
/usr/bin/athuhic -d 1567
1⤵
PID:1998

/usr/bin/hjcwtzykslp
/usr/bin/hjcwtzykslp -d 1567
1⤵
PID:2001

/usr/bin/gxqplimrghx
/usr/bin/gxqplimrghx -d 1567
1⤵
PID:2004

/usr/bin/aedkpix
/usr/bin/aedkpix -d 1567
1⤵
PID:2007

/usr/bin/rculbsvtfmcll
/usr/bin/rculbsvtfmcll -d 1567
1⤵
PID:2010

/usr/bin/dwdrpjymsatw
/usr/bin/dwdrpjymsatw -d 1567
1⤵
PID:2013

/usr/bin/kemivofipzflfr
/usr/bin/kemivofipzflfr -d 1567
1⤵
PID:2016

/usr/bin/qcjvamop
/usr/bin/qcjvamop -d 1567
1⤵
PID:2019

/usr/bin/meopzmb
/usr/bin/meopzmb -d 1567
1⤵
PID:2022

/usr/bin/qntodyw
/usr/bin/qntodyw -d 1567
1⤵
PID:2025

/usr/bin/ycgdvxv
/usr/bin/ycgdvxv -d 1567
1⤵
PID:2028

/usr/bin/grathsruwhj
/usr/bin/grathsruwhj -d 1567
1⤵
PID:2030

/usr/bin/umgkazyfyxa
/usr/bin/umgkazyfyxa -d 1567
1⤵
PID:2034

/usr/bin/zgdudyumrxf
/usr/bin/zgdudyumrxf -d 1567
1⤵
PID:2037

/usr/bin/pyvnfgizsqmu
/usr/bin/pyvnfgizsqmu -d 1567
1⤵
PID:2040

/usr/bin/kapjapk
/usr/bin/kapjapk -d 1567
1⤵
PID:2043

/usr/bin/sfotbakahl
/usr/bin/sfotbakahl -d 1567
1⤵
PID:2046

/usr/bin/fgclommheyd
/usr/bin/fgclommheyd -d 1567
1⤵
PID:2049

/usr/bin/ldlugb
/usr/bin/ldlugb -d 1567
1⤵
PID:2052

/usr/bin/ptmdmpgzq
/usr/bin/ptmdmpgzq -d 1567
1⤵
PID:2055

/usr/bin/mfvvkijy
/usr/bin/mfvvkijy -d 1567
1⤵
PID:2058

/usr/bin/qdtuzezkafn
/usr/bin/qdtuzezkafn -d 1567
1⤵
PID:2061

/usr/bin/wjrcvh
/usr/bin/wjrcvh -d 1567
1⤵
PID:2064

/usr/bin/cvydhylveh
/usr/bin/cvydhylveh -d 1567
1⤵
PID:2069

/usr/bin/wzxjeueqcprxgw
/usr/bin/wzxjeueqcprxgw -d 1567
1⤵
PID:2067

/usr/bin/xjbetydtjk
/usr/bin/xjbetydtjk -d 1567
1⤵
PID:2073

/usr/bin/pcsevrmrjqmjuu
/usr/bin/pcsevrmrjqmjuu -d 1567
1⤵
PID:2076

/usr/bin/frnovlaw
/usr/bin/frnovlaw -d 1567
1⤵
PID:2079

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/dev/shm/sem.0t8psl

Filesize
16B

MD5
076933ff9904d1110d896e2c525e39e5

SHA1
4188442577fa77f25820d9b2d01cc446e30684ac

SHA256
4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0

SHA512
6fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34

Download Submit
/etc/cron.hourly/wpubat.sh

Filesize
155B

MD5
eee5e3b4ebaf512af1bd7c0f93d1e727

SHA1
e9fcc62f76b43dab21a49114e05410d19542c4a1

SHA256
7c6ddc7a796231cd646a4370cb0f422f4e929373453da7833e84a96df3bf5c13

SHA512
e1c4996c46c6ff25ee9a029c400fb827e75c15772c56fc83e41e4a49a99d8742f4bc8a46d63e7c6ab100b6acefeb523896256703400f9d7406cac520cc230fe5

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
005f736884123978530a5a900d5e7a09

SHA1
aa0584a9f95b333048f63aa52764cfd765e6cb52

SHA256
703d5b6415de375c12f6ec243b0c67053a63da8a5150103531e0b49b02e03594

SHA512
bebf8ad75f6c1ff01657d884fa596b0e81e8143aef743caa21cd33d967adfc0acf24b8a34f1543d2bfb6145e789ad891ac7ca535b9def9e38549293c52c9732a

Download Submit
/etc/init.d/wpubat

Filesize
326B

MD5
2e49d12ff41bc24eb71c21c2f46af44c

SHA1
110cfd01064308cde034ef7f4be142a75c9951c1

SHA256
0e09ce20ebb1345db1493de31676de95a7fd32af38d8208e0bad85072036bf33

SHA512
853ccdda6346325ef5c7219e1d29dcb267e6f13d6f20bbd1a6bdb09be8f7393e9d63ea25e08e02142c1d18bfdf1107b129eeda076ba743e0510b9b3979ee08ec

Download Submit
/usr/bin/tabupw

Filesize
549KB

MD5
69a56c627bf5d215a7276025ee06d7ea

SHA1
394697b9ddaf066a4074707b0fa4a1667fcd286e

SHA256
4352fde5afe2b51bc44c4f0f54da87d9b1cc8ae4f58e99fa626534fee13b3384

SHA512
0251507d7bcfb30498615ff03ddac7f9cf9f6694a27ca6dba6278d078c68874840f0e1b1a6fbb6b246b0a4b0822a5c4896e9cf57f7dbd2b5e84b63ad7c7a9366

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads