xorbot

General

Target

bins.sh
Size

10KB
Sample

241201-cmtwkaxqcl
MD5

2e0f38cfc6726b8feda8dfd9a839df81
SHA1

d140fedfb105520013211fe1a1abbc9de5d560d0
SHA256

651facfa97c82b41031bd4d86471086561fd460b8d7a974018fd5f2fad2b81af
SHA512

900ecfb5f6760b7523bd53f377a30abdad640c34b4d3d180da8449bd8c84b7f47d41c80fa4757a289a1a99b14d657a1ddeffde3baa9b7dccfee61266bd76c029
SSDEEP

192:M/fXV8QRDE/Lj23cEns7Vw8sLjwEc7r//Lj23cFVw86DwEc7ri/fXV8QM:M/fXV8QRDE/Lj23cEns70W/Lj23cFq/C

Score

10^/10

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  2e0f38cfc6726b8feda8dfd9a839df81
- SHA1
  
  d140fedfb105520013211fe1a1abbc9de5d560d0
- SHA256
  
  651facfa97c82b41031bd4d86471086561fd460b8d7a974018fd5f2fad2b81af
- SHA512
  
  900ecfb5f6760b7523bd53f377a30abdad640c34b4d3d180da8449bd8c84b7f47d41c80fa4757a289a1a99b14d657a1ddeffde3baa9b7dccfee61266bd76c029
- SSDEEP
  
  192:M/fXV8QRDE/Lj23cEns7Vw8sLjwEc7r//Lj23cFVw86DwEc7ri/fXV8QM:M/fXV8QRDE/Lj23cEns70W/Lj23cFq/C
Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan antivm
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- Contacts a large (2073) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4