Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20250307-en -
resource tags
-
submitted
10/04/2025, 10:53
General
-
Target
task2.bin.elf
-
Size
611KB
-
MD5
a2792875c6a476bcb0256aba2a50bf7b
-
SHA1
571b871cb0f284489c28d9fc72057d6beef77057
-
SHA256
f0925a77cf0d973c935b9f65051bd27bf75887949adc3a06350210a2523961d9
-
SHA512
29aa5d8f29a0e3e8fc10cf2b8d457ffddd7c518c6eed3b8270a3387f463a550a4e3a3b75c678ce3abba3190f4a8607953d0e77139fb65266d29a6ccd907f000b
-
SSDEEP
12288:5BXOviwV1/n/dQFhWlH/c1dHo4h9L+zNZrrIT6yF8EEP4UlUuTh1Au:5BXNkN/+Fhu/Qo4h9L+zNNIBVEBl/91l
Malware Config
Extracted
xorddos
http://aaa.dsaj2a.org/config.rar
ww.dnstells.com:53
ww.gzcfr5axf6.com:53
ww.gzcfr5axf7.com:53
-
crc_polynomial
EDB88320
Signatures
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload 31 IoCs
-
Xorddos family
-
Writes memory of remote process 2 IoCs
-
Loads a kernel module 64 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/task2.bin.elf/tmp/task2.bin.elf1⤵
- Writes memory of remote process
- Loads a kernel module
- Creates/modifies Cron job
-
/bin/sedsed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab2⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl daemon-reload2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228B
MD53bab747cedc5f0ebe86aaa7f982470cd
SHA13c7d1c6931c2b3dae39d38346b780ea57c8e6142
SHA25674d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5
SHA51221e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42
-
Filesize
1KB
MD5f85f0a4cb1d0da23b7e8e4a80a5a9f59
SHA1f7b9ebeb87ee01c0caa97df076e6420f5e5c66a9
SHA256696de2ac7d880173f049febcf30288e8f77b4ff54baf7ea70ef1261a3bbe5d97
SHA512a770f7e2a0ce96ef084c9baf845148950ec23bd7a1e99d23438ff7872cfc039db690b10884e979de8aef200abde73ac5f69c9ce0cd7800ccda0b0ef0640eb27d
-
Filesize
330B
MD5b052fcfb6e57694058246853df989042
SHA1e41ad5325bb0a439652c3d3a476a20306b8176ab
SHA2561515905ade76fd61c449e2dcc34662474d36ea9223743b0d7bf6437a873b91fb
SHA5129a777aa5f0d4954508cd2cc8dd993d9a1dd54302436fe426e1fd229da12092799bd3b1ac014217f8bb2bacc43f56e3fb7e8f918ad467b6a4e13a501b4ceb53a8
-
Filesize
1KB
MD585f7ff2020ac8c72212f076ddf33c0be
SHA1df06ddd9c29e8da5cff1aa356e9529336573422f
SHA256ffb48ad57868ed639fad049d11ef4b9bcdd3d2d3e556754ce69b4d6b016969a3
SHA512d7e2d6116adbe768dd078b490575f7757c0e98859a96d280756446bd7e6bf46e24381b0cf86bf5ae3eb4e15bb3743a34cf910f30dd27888de4c5d12bc0a7ea00
-
Filesize
32B
MD544e03ccdfa210fbe39bc9080426c3300
SHA10a2edf55cbc4fad711fca283f2a9c5e2398b4b2c
SHA25637155919264943e61b808481c80d2accfc970d5ee13ce6e44fa4228b1dc10da6
SHA5122222e1d31ac6d355770b60b06cb899f7d1c23acb8ea6048fa191d0cc8411b09658296dbedbf9cd329b4e6aada371af5ca0796a47fb67ad0e2bdc11da5c3dddf3
-
Filesize
611KB
MD5a7bd42ff0c3784c8ef744cb7961f00ae
SHA1f8c6d32b2fc4d017d274d7b21ad9a25593606389
SHA25664222563118adb2ef68f4d79a12c3221c78c3b62b77f6d521a5d0ba1398afe89
SHA51212180190c44ce43764701985fd9ff7409fb2d6bc8f910719a322c2578f2762cce44546e29b0f53a7c6057a8a2b94a5356ecd8a4cb7fc376370a26b3bcaa5c4f9
-
Filesize
611KB
MD5f9ae1b242e5c824494da436d8d6b28a6
SHA14a6366f24f0dcb455fbd918d8e5e253a01bd7b68
SHA25643b9add614a7f55133412b869d9f09b8127386bf48aa976796a4a19aa3162f75
SHA5121dff16deb0991e8114de5546ac9d2479e94e2de73548fabbdef41d19b7d95618104a8987b6f15470d94750cf72593232d79b16ca33a9684dd0fe690c137a5e12
-
Filesize
611KB
MD521ed33be43a2c7f4650ac9fe93ccc885
SHA12da8a59dd39a0580eee37f7ca00a733db9fe564d
SHA2564d62f239ba6800a6303f3177b09bb6ffdda962daaae756356c6cc31d917f5b7a
SHA512130b50fc23c30b4f06776af9f3c2c01e17156c2cea3ec2a044a57a612393afdd60ed295afe9207fd10ab775b2a70005cb512b48d8503f8ea96f43f02c9356846
-
Filesize
611KB
MD581ea4aa0a169e37aa010da881c799015
SHA1c8d1a27d9afe94a7f9792af24c756ade61c4ecf6
SHA256f55bb3cc5ba0752a329ad6b07cf565d6f164290c6a1cf6054c693eaa7ac5d573
SHA51286f3441ebf8ef1bb8f4421d5c0dcb916e0a33ebc115a6f78775c96a307c36c4f4c33a94bbddd50d003bd8928804a40417daf631096c95ed4b1a0fa8530b5743e
-
Filesize
611KB
MD523f8bb2470ba620dc6f5ebced3f34bea
SHA1d2e7fc831c4f767602c306d71dc40561c5b1f716
SHA256dbbad0d1d4a1917dc9dcfd5c0dd20f181d7e819a49e29e95022d0e9751f60486
SHA512e7b7db5ac5b4099cd6614b9ff9ad1df5da4303d7d3c45fa5acb634bd4852971a960839defa1dc18df84db525694cbac321ba3d141077557a7b137066925bc9ec
-
Filesize
611KB
MD5628b775dd28ec69578607745ba6b229f
SHA17d0fb6dda8332d8345cc12ee4a4072d153cf8856
SHA256b80c5880373371571ae159f059496e31154823b61973e6fae5902492f4184bd0
SHA51202853a57a8b69137eb2e9405e9689d7f419647d1f773dc25123060c7ed6e11533404164096330ae0adfab1fda98a0052f4748da08c1bd4150a360f9660855fcb
-
Filesize
611KB
MD5c9d33821ee972d20383b7668570ed0ee
SHA18a86158331207d65d11c9d952ec83bd141b20f5a
SHA256b342cc931e0d39116647800d52cdf23ab7927fd84aa591525af6c4ab97879ded
SHA5127fd1e768fd33de262c9d0258ea6da20b6c5810f74cae5abde2b998d4f631a8adb086a6effcf5e5d0438e902973d6fa10435a20570cd08b247ce6b6e679c10987
-
Filesize
611KB
MD50c630c050871f8aab417b17cc90af9d4
SHA18157ee259de98054fcf2a436abcc8c2638b473ea
SHA256f06011aab825952d3abfd08af36abf4ee2eb6cf8083f803f8e1e4a082e9df2d5
SHA512c63158e254971599a6986475c4bb1979e2c4c5610a28521c2c5f6cf96930599ecb04f301ce14af3639c562761e7c9cb71514a2df2bc01f325ee01882bde9a42b
-
Filesize
611KB
MD557e1f25bb6c86de6d60c2d0ff35b9361
SHA10e3a6cf70d7aa44a34f9d1bfcfe5fe3db00abe5f
SHA256fb3efb8152784ffc88d86d939a30d882b81a3de96774f97d2e4a024d41cad7c3
SHA512d7a51ae1737fb033c8db514d550fd0a91d32b14e16eb0cfe8b783b5f8ed86d4ecc440a31ac8ad05e694ddabd97f787aee21588c6340733c182ce411c0af37cca
-
Filesize
611KB
MD5dabbc3a82e19e93f95bf1d3db4424443
SHA1aaac8a8b56b86e3b61595af855a624e22bde430e
SHA25680e5fa35644c85d18ee50e5732847eee8820f3425ac843bf4372269b01b941bd
SHA51256411825969e0995f0686b94fbfec51a4897b54c1cff2534fda6b04c65d665ffc44d67d7b57d84b59a3f34752e02f5e28c8705c9aa9f78a8a5c6eb97895f68b8
-
Filesize
611KB
MD5236e600622e960ea57af55cacb7bf6d4
SHA1e8b249d181d404816e15ba65812d8c0d9a91d9d6
SHA256af39984020453d914f9b7d611bc1a976b7241e3bb429fe3074674e4e0b3138ac
SHA512fc7b6668a392f5011e1ca38ba50b7472bfa750a1aa7ce32f97066d7bd3323839dae584d716465795ca5e87ceb59dad1e80c13e49d57eaa0e1863cbf12247469e
-
Filesize
611KB
MD513de4398bc275d06a0297849bee39772
SHA17daf35697642f0d5518ff283fbba386f2f310855
SHA256edce88efd7023165e1ed0bfe557f92e909095aa40542fca9566309d6f1198fc7
SHA512648a9a9b962a57ef917e8807189227e59e9fc924d6c0640ab82312fd0c0fdf08a754af40cc859c1fd2c62217e2cc3bd80cbc7833ab938c8db3c1a658055df06a
-
Filesize
611KB
MD566af1b7c822069b9e2abbdeb0b498aea
SHA1a4853500a469ff6f871fe098e83684087fccb25a
SHA256fe2db32d3faf9da20b3b9689362ed505f7c13991c09baa5ca5e6759b870aad99
SHA512d258ba70a6a50eb46884208c06cb320932f1fb6b3fcc9050a9f76e4af504ea48f3f9207a5ae20f5a14ec430426fb9465aab4d3ef43460ed55846de398f0f6a0f
-
Filesize
611KB
MD56b6b3d394931138160c1bbafd75bfbc6
SHA1e6952367e912ff550ad8c12f17dbf131a79587ad
SHA256b668b924886aafa2bc762654e2e426fe048ddb54b0ef7364e74126a3b13be2e5
SHA512d5b851ef9296d4bea4d4a09256beef7ef6d1a01798b6e6297cb27b5f20df8aa2f310a593b10565f8ee67a318fa1b452b67e24ceb0be225500440a147f9819816
-
Filesize
611KB
MD5ae00221554db349e937b56556a787697
SHA1c99bbbe703835dd5f5931dc3afedc622a6ef4969
SHA256a6ce9b3b9df9cd9657834499c66c5639f60de9d2badaa3a7621a8c02664ccc22
SHA5121af6485efdc1ebf733c36c0dc177ebada13e54fc341d42b6a199a42d8191baec41b1745ca51361d502c89f55ea707f0e99623c125f41138c6fdfe9a9a8c91640
-
Filesize
611KB
MD58328cd56d8c87825389c3ad6b70e532e
SHA180fa9aabd0cc2f1e01a5defb5c24f6471119f6ad
SHA25694d8014b16b6f894c3e741952f0c6a55a895aba173dc58270951370bd828a721
SHA51259cb6242d9d5620e2fc8505f0d6a1a762a29337ed75421f92d52f9d6147ed467f131a68e67ff24827a7ccc7898fb410305ad52d48f04e4daf1073801aa4ef2b4
-
Filesize
611KB
MD539654ed88b3d587ae9c5e26b7926478d
SHA1502f4e0582248838619cd70cc72a9b2e27f43b50
SHA256ca0f9efa7c9e509ea24a892f03e74928c3e2b37eea3df51dd198c0c17cee5181
SHA512ed20c30b4e8fa3ee9156171837dee43839ad7ffec0d923d8b623751aca7dcf696a03fd5abb0b501b9015595e3f0db0d9630fd68660949637fd767b1dbd82325b
-
Filesize
611KB
MD58b68d517dabe06e88e613257dc785598
SHA14fd2e9ac90333ee7ff07dd2b6c4173d673b4ddd8
SHA256a3a8c416f20c2a6864379ab00702d4a647091b740d68309619773521b9a5d543
SHA5124cf5106b67945a579d9bf56e852ce77e3aede9332d3f030a19c8b0aff2138ac274b2ab175c8cc7da4003b6a5b94f047ab6070fa2513b3a0877a78286e5f33b04
-
Filesize
611KB
MD551fff22489dc89054f7baab0920802e6
SHA18c806990fbe7eb8049b2e7b215bf489908d1e21d
SHA256771e3629da26b4fdaf18caa3207e4cc8187fb2c0352894e74f12024228fab69e
SHA5123caf350bc63a165f5b8d9605f47fa866a1fd9efd8458babc54078855c5a55cbc7a51e2542f3cffd3f6cc63313e7251263642cecf11c8bdb4f2dbdb619589efa3
-
Filesize
611KB
MD5979f6b41c151fdc994a079cc68b90671
SHA1f8b93d63a1aab4de7f42563d5d4295bdfba8e6ba
SHA256672b700b7ca6b40a8bb611038833d6afb082b4eb059e92e3fd451cc15fab6237
SHA512afda4eb60878ca554ab919d091eaac5e9a1f589800b725157b40a71d46301bdb0a054c5809c9a82b92b1710a6634aec7eb045a739b34f0b5a90c5b47105f9257
-
Filesize
611KB
MD5a2f59299ad4b47fe69fefed9bf9a78c4
SHA13a6362b9b91fcb7c529ab7c71ee3bbfcab0d3b41
SHA25622916fc3fca05848f1e20b9eee57095c24b1f93e7c22dfe3a747fa1153878263
SHA51246e4e7417f3eef0dd2ad1f3e9440d1e52bd9cd701e77264b735963f778cf259953ee82e1d655e0b2b0bae48dd6fbeddc7f1128b30a259ebbc1a7e6b166ca2114
-
Filesize
611KB
MD560a49292e50ad4799aa5ed329f483b77
SHA1b34a6fbf9756c7868964d71343497e06e194fda6
SHA2566fd250a14416f81223bcf10ae63223ee40d6fa0a8f3881c9c2b6e61b8681a4b8
SHA512b18eb08a98d64675dcbfe331e9abdbb7d4d9434952a1cf20ee44ab0bd152ccee3c9487b680b80497545c8dc85540aaecdb42c7913fdb935fdc21c542aa38d667
-
Filesize
611KB
MD58f62a18408b32398ae750c3b84a26564
SHA13222eefbc7c99d6f4e88ff22cd7b41fd9c1242ac
SHA25663018efac8a06cfb542eaa1b7d62261b5421f0f065665b6acd21c54b0df9af0c
SHA5124597b09ca119ddc82ba8c8236412343cc5c42a706bf8002f34d6fa27dca526dfab7ed018480ee74eba5418f352a4d79faeaa7131e2db818f1bc96d3bf5d01765
-
Filesize
611KB
MD5422f74b521ed4be89b43668364d1d4dc
SHA1c17c8ef9eb348cc0aa7086313c5684eb8b3a68cb
SHA256aa37e2a8ccbb728ecc46018e6872a115362b2b8f486f80083ce574a5d56b4e13
SHA512833ea93c4bf536a6d8edb62c8c8b1b90f5e88e1ba24a3135c767e96452687ac16d98881653809b295d8c24e2c74feb1765ad8ac30aab20c992ffc5fac46bf61a
-
Filesize
611KB
MD5ba9ebdb00a66cce3a091c1c2d8164f7d
SHA1e079d33041212ecd4cab3781253abfcd8a278877
SHA2568a382106d2cfc9522de170d8d27611324d2fdcf2a9dc3b765dfcf2e0f385e055
SHA512a5a3de821e029eeebde6e976ba96793a612731f2620785bacf5ee91a7ccbdb9f8421ce0c230c0c07dfaf02a8112123082ddab2355b1b439b7654bd7cc75bfa39
-
Filesize
611KB
MD5f2d4e733f3b5bcfd9e5e21081f54bc7d
SHA114d7c2a55f28784e6f409a203b9b7f75c8830164
SHA25666036b7f1ae5bb7d720f3c7256de93076b78678f6c7e6a2778361a2af40a24b3
SHA512363601ca2b41f9f54db68432d56c8f369e223c8b8afa51f4b879e7d7a4832abf1e212b54061d4d3902689cb3e1b1c68a5a278a18e1e6e8c925356768f9558726
-
Filesize
611KB
MD5ee51e3f09874689f3114846cdab193a3
SHA128e66084c9839427143eb53257e52b2852120619
SHA2569225b6a40a399a223aad0221267b505c61750e61bfea2fe9638c729fa600854c
SHA5127cdd0d06e8baf71c51f40fcc1a1eb41496225fb686bf07fbecdb2b20aaed1d7d890a112a227dbd2b2c2244b9c8ca744f40d2fc29078c99a4e65feeceb982587b
-
Filesize
611KB
MD56f9d7bb31f3888cec06c6a7ca5b4ba36
SHA12c6b90abdaab5b6ad6cc7ab48f543a77efd9fb31
SHA2568306e98f081aabc7151ec921fae45afba1553b0cefffcc0da681f6c5787db27a
SHA5128c1f387eecff4d48bea090e0f54e264e2c05a0dce7c0adf0dfd71f4694e3567f306f1a168c7ea86e50e7703e40a524b7f06ffe033a3466deb7ddc2f81c34edd9
-
Filesize
611KB
MD507dc21bd156d973d22e2d2fc9bb5b698
SHA1a7655e3954dc7c099b37019cc875dad490eaad0d
SHA256b969c7dcb5b11ce8f9b97883c315a5f2482af2c8f44d388b457af8a9c4ab0914
SHA51207b66c7cdd4bc68336669a6e91cc601e865c6fc297f4b99ffa615e922b213de38a2f506999c2b62b3621f579d9018f20180d04b5f8f7dfdafd9759c629cde094
-
Filesize
611KB
MD54055ccdf1123d8b435fd4e3004020a10
SHA16fbca85ad462e6afce040779d0a6461d438cf315
SHA2567314b6b43c5c86912d33a988ab6d98eb8c270b2ab3851421f165c93de43df2c7
SHA51214047ec18d5f0fd3aa68f854f409fb4a674447321f43d751478fea110b2474da95f5cd82e11acf8c921b1d972effc388e016e3e1c539b17b887f6d1200cf32f2
-
Filesize
611KB
MD5a2792875c6a476bcb0256aba2a50bf7b
SHA1571b871cb0f284489c28d9fc72057d6beef77057
SHA256f0925a77cf0d973c935b9f65051bd27bf75887949adc3a06350210a2523961d9
SHA51229aa5d8f29a0e3e8fc10cf2b8d457ffddd7c518c6eed3b8270a3387f463a550a4e3a3b75c678ce3abba3190f4a8607953d0e77139fb65266d29a6ccd907f000b