General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241203-ttmt9sylem

  • MD5

    f6bd33e2fdcb1e0896028c8af8d15c0b

  • SHA1

    19ac7736e1325c6b2f90a67e915cbf04b778d6d3

  • SHA256

    fb49bd7f52a014b5e07587fb826822f3884b9ecc8a40380dcd2c0f58284f4de4

  • SHA512

    2548568c238900b5445d454b38ca9c33d7d55f0888615a5057058aacd5980ca49d60d2084da5f43764db0b92a08fa1e5411fcfd18c628a0c1212ebcb5781b032

  • SSDEEP

    192:ntdYqZnD6Jb48QutTRtcHZ8QutTRtitdYa:8qZnD6Jima

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      f6bd33e2fdcb1e0896028c8af8d15c0b

    • SHA1

      19ac7736e1325c6b2f90a67e915cbf04b778d6d3

    • SHA256

      fb49bd7f52a014b5e07587fb826822f3884b9ecc8a40380dcd2c0f58284f4de4

    • SHA512

      2548568c238900b5445d454b38ca9c33d7d55f0888615a5057058aacd5980ca49d60d2084da5f43764db0b92a08fa1e5411fcfd18c628a0c1212ebcb5781b032

    • SSDEEP

      192:ntdYqZnD6Jb48QutTRtcHZ8QutTRtitdYa:8qZnD6Jima

    • Detects Xorbot

    • Xorbot

      Xorbot is a linux botnet and trojan targeting IoT devices.

    • Xorbot family

    • Contacts a large (1512) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.