xorbot | f609f5bfc7e3d5210e05714eb89a2d41b6fbe6c724e36c95db6113c75ebaf1b0 | Triage

Sharing

General

Target

bins.sh
Size

10KB
Sample

241129-s5bqpstkgz
MD5

b91e106ff02c3a44407db7510d190b3b
SHA1

9881a6a9fffaeec6083184f37ab1364b6e4024e8
SHA256

f609f5bfc7e3d5210e05714eb89a2d41b6fbe6c724e36c95db6113c75ebaf1b0
SHA512

00aa727b0d4cb91c07fe7b94185a2d0bfee9bceceedd9e7d1d5a21a78659aad3e2181ec672bd5edaa9c10361a66045b7b62a5a8500c0d8e6a06f447907f38c6f
SSDEEP

96:Yswl6Lvcnvc7vcecRcpch3LiQ3auL5RHELFlRKCVSqzLcgZLm3GMDfZrHZhLsGTq:26QkARaSVPLEvhcBXbBtkARaSC

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution linux persistence privilege_escalatio trojan

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  b91e106ff02c3a44407db7510d190b3b
- SHA1
  
  9881a6a9fffaeec6083184f37ab1364b6e4024e8
- SHA256
  
  f609f5bfc7e3d5210e05714eb89a2d41b6fbe6c724e36c95db6113c75ebaf1b0
- SHA512
  
  00aa727b0d4cb91c07fe7b94185a2d0bfee9bceceedd9e7d1d5a21a78659aad3e2181ec672bd5edaa9c10361a66045b7b62a5a8500c0d8e6a06f447907f38c6f
- SSDEEP
  
  96:Yswl6Lvcnvc7vcecRcpch3LiQ3auL5RHELFlRKCVSqzLcgZLm3GMDfZrHZhLsGTq:26QkARaSVPLEvhcBXbBtkARaSC
Score

10^/10

discovery xorbot antivm botnet defense_evasion execution persistence privilege_escalatio trojan
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Scheduled Task/Job

Cron

Privilege Escalation

Scheduled Task/Job

Cron

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Network Configuration Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

xorbotantivmbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

behavioral3

xorbotbotnetdiscoverytrojan

behavioral4

xorbotbotnetdefense_evasiondiscoverytrojan