General
-
Target
bins.sh
-
Size
10KB
-
Sample
241201-p52qca1rdv
-
MD5
471fda7ae47efbd3a7ae13a187d7dd6c
-
SHA1
48ee8b96d4a32ba6b5cc63e5b87890c51d7312d8
-
SHA256
4fa56931653e1b3afa0f8f7117bb2e5b1e9cef8bc0eba4e46d11a7c5081cf4c8
-
SHA512
7f5e3d7bec602fd4d50299d9209e83b16a2d91fae16dc5147688db3f69b77da906a15440eda309cd2c29e5f7d33e0070d5438786a00d5fa52a325b70dd1d236d
-
SSDEEP
192:wrOt6BXNXDSy0fjsP+yCtFDjHA35+yCtFLjHt2Ot6BhjSy0fjP:wrOt6pNXDSy0fjsP+yCtFDjHA35+yCtR
Malware Config
Targets
-
-
Target
bins.sh
-
Size
10KB
-
MD5
471fda7ae47efbd3a7ae13a187d7dd6c
-
SHA1
48ee8b96d4a32ba6b5cc63e5b87890c51d7312d8
-
SHA256
4fa56931653e1b3afa0f8f7117bb2e5b1e9cef8bc0eba4e46d11a7c5081cf4c8
-
SHA512
7f5e3d7bec602fd4d50299d9209e83b16a2d91fae16dc5147688db3f69b77da906a15440eda309cd2c29e5f7d33e0070d5438786a00d5fa52a325b70dd1d236d
-
SSDEEP
192:wrOt6BXNXDSy0fjsP+yCtFDjHA35+yCtFLjHt2Ot6BhjSy0fjP:wrOt6pNXDSy0fjsP+yCtFDjHA35+yCtR
Score10/10-
Detects Xorbot
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
Contacts a large (2152) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Renames itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1