General
-
Target
112.sh
-
Size
308B
-
Sample
250510-g5hcpsvvgz
-
MD5
53ff5173c085a698036707289dc16ad5
-
SHA1
b0718127211a39286a4dde03fbaca1c1d7723ad5
-
SHA256
2a118171db67cc79402839884415a075851d1d208753197f44359961c3ff6c84
-
SHA512
29c21f7ad939bb00d3134606657587a1f8e9627a402a8008c3e86cfa883f270610fcd77425451e0fb19103b0ea6a8669147cc88e2c8aeeb9c7f5b92f49f6411b
Static task
static1
Behavioral task
behavioral1
Sample
112.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
112.sh
Resource
debian9-armhf-20250410-en
Behavioral task
behavioral3
Sample
112.sh
Resource
debian9-mipsbe-20250410-en
Behavioral task
behavioral4
Sample
112.sh
Resource
debian9-mipsel-20250410-en
Malware Config
Extracted
xorddos
whois.checkokdomain.com:112
winrar.monstervp.com:112
http://qq.com/lib.asp
http://aa.hostasa.org/config.rar
whois.checkokdomain.com:21
winrar.monstervp.com:21
-
crc_polynomial
CDB88320
Targets
-
-
Target
112.sh
-
Size
308B
-
MD5
53ff5173c085a698036707289dc16ad5
-
SHA1
b0718127211a39286a4dde03fbaca1c1d7723ad5
-
SHA256
2a118171db67cc79402839884415a075851d1d208753197f44359961c3ff6c84
-
SHA512
29c21f7ad939bb00d3134606657587a1f8e9627a402a8008c3e86cfa883f270610fcd77425451e0fb19103b0ea6a8669147cc88e2c8aeeb9c7f5b92f49f6411b
-
XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
-
XorDDoS payload
-
Xorddos family
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes itself
-
Executes dropped EXE
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1