XOR DDoSMalware
- XORDDOS
Linux DDoS C&C MalwareFrom MISP Galaxy
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1001Data Obfuscation
“| | T1001: Data Obfuscation | |”
- T1005Data from Local System
“| | T1005: Data from Local System | |”
- T1007System Service Discovery
“| | T1007: System Service Discovery | |”
- T1027Obfuscated Files or Information
“| | T1027: Obfuscated Files or Information | Software Packing |”
- T1027.002Software Packing
“| | T1027: Obfuscated Files or Information | Software Packing |”
- T1027.008Stripped Payloads
“| | | Stripped Payloads |”
What the reports say
1 report, newest first · the exact sentence from each-
Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse“Malwares such as KAIJI and XORDDOS are known to place executable files in the /boot/ directory, and leverage these to establish persistence while attempting to evade detection.”
Indicators in its reports
named in the reports above- auto.c3pool[.]orgin 1 report
- hxxp://61.160.194[.]160:35130in 1 report
- 61.160.194[.]160in 1 report
- hxxp://107.178.101[.]245:5488/l64;chmodin 1 report
- 107.178.101[.]245in 1 report
- hxxp://107.178.101[.]245:5488/l86;chmodin 1 report
- hxxp://107.178.101[.]245:5488in 1 report
- nishabii[.]xyzin 1 report
- c3pool[.]orgin 1 report
- hxxp://91.92.241[.]103:8002/gk.phpin 1 report
- 91.92.241[.]103in 1 report
- hxxp://62.72.22[.]91/apache2in 1 report
- 62.72.22[.]91in 1 report
- hxxp://62.72.22[.]91/apache2v86in 1 report
- hxxp://gcp.pagaelrescate[.]com:8080/ifindyouin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.