Overview

overview

10

Static

static

10

8f8f05f9f03166db.elf

ubuntu-18.04-amd64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    8f8f05f9f03166db.elf
  • Size 596KB
  • Sample261111-2p62castgv
  • SHA256 8f8f05f9f03166db4d78c157faeb6d12d6802db6fa0cb56656892aebc389752a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xorddosantivmbotnetdiscoverydownloaderexecutionlinuxpersistenceprivilege_escalation

Malware Config

Extracted

Family

  • xorddos

C2

  • dns-google.org:60000

  • a-dns-google.com:60000

  • uc.twjiasu.com:8080

Attributes
  • crc_polynomial

    EDB88320

xor.plain

Targets

    • Target
      8f8f05f9f03166db.elf
    • Size 596KB
    • SHA256 8f8f05f9f03166db4d78c157faeb6d12d6802db6fa0cb56656892aebc389752a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    antivmbotnetdiscoverydownloaderexecutionxorddospersistenceprivilege_escalation

    • Family: XorDDoS

      Botnet and downloader malware targeting Linux-based operating systems and IoT devices.

      botnetdownloaderxorddos

    • XorDDoS payload

    • Executes dropped EXE

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalation

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Write file to user bin folder

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks