General
-
Target
bins.sh
-
Size
10KB
-
Sample
241130-l8gyka1mft
-
MD5
e3acbc4ed14dedc6b101819151aa8e11
-
SHA1
c27ad3916863d50bc1001b95d0fd39d831e3eebc
-
SHA256
0d5e5ac44a1561346bce5197d027dbf920fc6e3a8f162b38ac4c03f953705544
-
SHA512
4380b6cf9fb1a11c9de70e3a48bf8873868360ff194a33ce5e2a068ac913017ce7640510963cfed31e38d742fba3f13c5873fd56b1cb45939b96518558d61657
-
SSDEEP
192:P/2hN5CGevfxme2NpJaWq20n/uqRqxqrqCbqQq6zdVhN5CGevf5me2Np/q20n/I7:noaxzdcq
Malware Config
Targets
-
-
Target
bins.sh
-
Size
10KB
-
MD5
e3acbc4ed14dedc6b101819151aa8e11
-
SHA1
c27ad3916863d50bc1001b95d0fd39d831e3eebc
-
SHA256
0d5e5ac44a1561346bce5197d027dbf920fc6e3a8f162b38ac4c03f953705544
-
SHA512
4380b6cf9fb1a11c9de70e3a48bf8873868360ff194a33ce5e2a068ac913017ce7640510963cfed31e38d742fba3f13c5873fd56b1cb45939b96518558d61657
-
SSDEEP
192:P/2hN5CGevfxme2NpJaWq20n/uqRqxqrqCbqQq6zdVhN5CGevf5me2Np/q20n/I7:noaxzdcq
Score10/10-
Detects Xorbot
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Renames itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1