Overview

overview

8

Static

static

3

zilko.xdbo...d32.so

debian-12-armhf

1

zilko.xdbo...d64.so

ubuntu-18.04-amd64

zilko.xdbo...d64.so

debian-9-armhf

zilko.xdbo...d64.so

debian-9-mips

zilko.xdbo...d64.so

debian-9-mipsel

zilko.xdbot.dll

windows10-2004-x64

1

zilko.xdbot.dll

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    zilko.xdbot.geode
  • Size 3.7MB
  • Sample260703-mx84cafw81
  • SHA256 495992081978b1e9171a4b3a16f53d5764c6b76917343ee90a07abeb92857113
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarelinuxpersistenceransomwarespyware

Malware Config

Targets

    • Target
      zilko.xdbot.android32.so
    • Size 1.5MB
    • SHA256 6360d7ddd51f9d87c97fe31f91ab92bf2d27ddeb6b4730fb028310b0c987ac34
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      zilko.xdbot.android64.so
    • Size 2.0MB
    • SHA256 7f4061bf74527dc49518e4f898a66d6d24b19779ab4e2e31b6a43fe302153e63
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2behavioral3behavioral4behavioral5
    • Target
      zilko.xdbot.dll
    • Size 2.4MB
    • SHA256 d86bc67a63d52d00bb783d2722a5a3d03a6e05e53ab21385b83ef50114b756f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral6behavioral7

MITRE ATT&CK Enterprise v16

Tasks