Extracted

• • Target

    malware

  • Size

    542KB

  • MD5

    c77b5dbffd05dd733b608cee21b1d4a0

  • SHA1

    d1cb77973c4a6e23aebc5bdb053ad3289960a86b

  • SHA256

    fee023e78183af702d8f57bdbfda2ded848cfa88acae2abb4d63aa24fe30c951

  • SHA512

    7c95d9bf5729897fa037b37aedf1242f10129982dd3e09422c008f8ee07bf9f91adb902334faa987f8c4af2d762553fd4ac07ae5d5d008c34d510375689fdf71

  • SSDEEP

    12288:VB2bw1CH/FwznbIU9sE8c8lqd49N94wT4JXhLLp6yWrk3k:VB2WCH/eMU9Uc8gd49N94BJXhLL4ruk

  Score

  10^/10

  xorddosantivmbotnetdiscoverydownloaderexecutionpersistenceprivilege_escalation

  • XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Xorddos family

    xorddos

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1