Analysis of recent linux malware:

Today we received a linux malware sample for analysis.
MD5: 26413FD652A4ABB3FCA4A936DE6A4736

remnux@remnux:~/Downloads$ file ntpd
ntpd: ELF 32-bit MSB  executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped

This sample appears to be attacking bot. Let's look at the strings:

IOC details

• hxxp://majestic12(.)co(.)uk/bot.php
• hxxp://89.38.96(.)67/tftp
• 89.38.96(.)67
• hxxp://94.177.172(.)221/John.sh
• 94.177.172(.)221

Post made by

newWorld