echobot

General

Target

ohshit.sh
Size

2KB
Sample

241125-1fwnkstrel
MD5

81eee2b1d28af46c8e9190b0c20fce28
SHA1

8025e6d6f83b129d6c7a11a684d5d6f54d160333
SHA256

b86582605641a45410c0811cec9d1d19deb98bb5c4f5cd27caa06949e2ec7e30
SHA512

359baa5371f4f8cbd4c3caf9cb1b02624b22d8cadd63722c2a9db673e73df55f6f75988e988911ee731e3b30b5a1c22207cd9a8aebb933c38bab17f9a1f8df45

Score

10^/10

Malware Config

Targets

- Target
  
  ohshit.sh
- Size
  
  2KB
- MD5
  
  81eee2b1d28af46c8e9190b0c20fce28
- SHA1
  
  8025e6d6f83b129d6c7a11a684d5d6f54d160333
- SHA256
  
  b86582605641a45410c0811cec9d1d19deb98bb5c4f5cd27caa06949e2ec7e30
- SHA512
  
  359baa5371f4f8cbd4c3caf9cb1b02624b22d8cadd63722c2a9db673e73df55f6f75988e988911ee731e3b30b5a1c22207cd9a8aebb933c38bab17f9a1f8df45
Score

10^/10

echobot mirai botnet defense_evasion discovery trojan antivm
- Detected Echobot
- Echobot
  An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
  botnet trojan echobot
- Echobot family
  echobot
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Mirai family
  mirai
- Contacts a large (131682) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4