Overview

overview

9

Static

static

1

RDDoS_Tool...ool.py

windows10-2004-x64

3

RDDoS_Tool...ool.py

windows11-ltsc_2024-x64

3

RDDoS_Tool...tup.sh

ubuntu-18.04-amd64

9

RDDoS_Tool...tup.sh

debian-9-armhf

3

RDDoS_Tool...tup.sh

debian-9-mips

RDDoS_Tool...tup.sh

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target
    RDDoS_Tool-main.zip
  • Size 443KB
  • Sample260716-ds9pmsb16q
  • SHA256 e17272b65ecd68f477b21b551e0a9d89c9d2f279424dd40fdab3221eafaf1f2e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdefense_evasiondiscoveryexecutionlinuxpersistenceransomware

Malware Config

Targets

    • Target
      RDDoS_Tool-main/RDDoS_Tool.py
    • Size 5KB
    • SHA256 3be355aaa34f541f1a66ac70d7ed7b2159ddf7f057075c4b7a6fd0d5a1ab213e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral1behavioral2
    • Target
      RDDoS_Tool-main/setup.sh
    • Size 515B
    • SHA256 f73d05b428a695cf2aeb5a40439d912c268c7e0e9d37080e087aaf8bd2790339
    • MD5 SHA1 SHA512 TLSH
    Score
    9/10
    credential_accessdefense_evasiondiscoveryexecutionpersistenceransomware

    • Renames multiple (106) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • OS Credential Dumping

      Adversaries may attempt to dump credentials to use it in password cracking.

      credential_access

    • Deletes log files

      Deletes log files on the system.

      defense_evasion

    • Write file to user bin folder

      persistence
    behavioral3behavioral4behavioral5behavioral6

MITRE ATT&CK Enterprise v16

Tasks