Extracted

• • Target
    2baf73eae1c5135acf10290b063d0a65827611ba6874a326883d9be3b238a1b6.bin
  • Size 611KB
  • SHA256 2baf73eae1c5135acf10290b063d0a65827611ba6874a326883d9be3b238a1b6
  • MD5 cc3cfcdb09c10250d5b6430a1ffa5340
  • SHA1 d31cd0f813ac9a6f997d7d5a0cabac6d078907e2
  • SHA512 a519cd6606a3383dbfb80d0ab96877d416bc089f5076b92b47e31edc3e0ef7b6ed21e38e4577e063a48c97d1842557667bef046a70be87b5d71792ab14a988b5
  • SSDEEP 12288:UB1tATMVAqnf+ExxBHYpmA38X8LYkCW6Tiux6yB1/iGK4UlUuTh1Af:UB1BVpmExDYp38X8LYTWhufNiGQl/910
  • TLSH
    T1D2D47C06F282EAF7C8570970124BF7BF4230E2359412DF8AB6889D1AB9379F5664D317
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoverydownloaderexecutionxorddospersistenceprivilege_escalation

  • Family: XorDDoS

    Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

    botnetdownloaderxorddos

  • XorDDoS payload

  • Executes dropped EXE

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence
  behavioral1