General
-
Target
bins.sh
-
Size
10KB
-
Sample
241129-qp3s5sxpdv
-
MD5
0f1ab6ac305389f1651f86ae8ee9487a
-
SHA1
cc133fbbf8643f3760dbd7399724c620cc9e2ae3
-
SHA256
987822b12edf58efb6a80d22ef3e6ea7cfa0d308fc363137aebd9471dc52e055
-
SHA512
b828c6748e67d60491dbc1ce7d10fc3f6aaa10e8dbc12e07711adecc9f01c1c2970099204050333e4846e85263206ce32a5acb153e081038b322e17b43ec7572
-
SSDEEP
192:dI34uu03vbUxuYVaSlRJ66TlRJ66v7Buu03vbaf/:dI34uu03zUxpVaI1uu03zaf/
Malware Config
Targets
-
-
Target
bins.sh
-
Size
10KB
-
MD5
0f1ab6ac305389f1651f86ae8ee9487a
-
SHA1
cc133fbbf8643f3760dbd7399724c620cc9e2ae3
-
SHA256
987822b12edf58efb6a80d22ef3e6ea7cfa0d308fc363137aebd9471dc52e055
-
SHA512
b828c6748e67d60491dbc1ce7d10fc3f6aaa10e8dbc12e07711adecc9f01c1c2970099204050333e4846e85263206ce32a5acb153e081038b322e17b43ec7572
-
SSDEEP
192:dI34uu03vbUxuYVaSlRJ66TlRJ66v7Buu03vbaf/:dI34uu03zUxpVaI1uu03zaf/
Score10/10-
Detects Xorbot
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Renames itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-