Overview

overview

10

Static

static

10

9b79190de8...28.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9b79190de8b50ae1a916c2bd27195e0a3278bec33bc2255e0980efbee2cdd728.elf
  • Size 542KB
  • Sample260806-raphmscr4s
  • SHA256 9b79190de8b50ae1a916c2bd27195e0a3278bec33bc2255e0980efbee2cdd728
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xorddosbotnetdiscoverydownloaderexecutionlinuxpersistenceprivilege_escalation

Malware Config

Extracted

Family

  • xorddos

C2

  • https://set.74fkhlsdg12.la/config.rar

  • 1530.ifjl1234187.la:1530

  • 1530.74fkhlsdg12.la:1530

  • 1530.hskf123sd.me:1530

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      9b79190de8b50ae1a916c2bd27195e0a3278bec33bc2255e0980efbee2cdd728.elf
    • Size 542KB
    • SHA256 9b79190de8b50ae1a916c2bd27195e0a3278bec33bc2255e0980efbee2cdd728
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    botnetdiscoverydownloaderexecutionxorddospersistenceprivilege_escalation

    • Family: XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalation

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks