xorbot

General

Target

bins.sh
Size

10KB
Sample

241204-qrj4tawrax
MD5

3edce6c590ad87ba627b4ce0f9ab1a02
SHA1

a47f28477a3b672132deb0af3e3cd214f020bb04
SHA256

ed5138a5800c6bedfbcd9e9a46d11323dcc2696d92bd42f1d99c46d7bf07f4bd
SHA512

b8687eeb804b48d6a1aa0726cdedd9aabda86144e5c111b2ffcabc6f4a795d17bdb5b9c4dc55072094f4e5d6c7385b6b74693b5bed914677adce9ca8aad51701
SSDEEP

96:r3/beW4YNrxvuy6DTKJGJGJsJXJzw/O28PMewJGJGJsJXJzhSlD942KP4De/7uy8:r3/bd4YNtvuy6DTt1E1Ouy6DT6/bd4Y4

Score

10^/10

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  3edce6c590ad87ba627b4ce0f9ab1a02
- SHA1
  
  a47f28477a3b672132deb0af3e3cd214f020bb04
- SHA256
  
  ed5138a5800c6bedfbcd9e9a46d11323dcc2696d92bd42f1d99c46d7bf07f4bd
- SHA512
  
  b8687eeb804b48d6a1aa0726cdedd9aabda86144e5c111b2ffcabc6f4a795d17bdb5b9c4dc55072094f4e5d6c7385b6b74693b5bed914677adce9ca8aad51701
- SSDEEP
  
  96:r3/beW4YNrxvuy6DTKJGJGJsJXJzw/O28PMewJGJGJsJXJzhSlD942KP4De/7uy8:r3/bd4YNtvuy6DTt1E1Ouy6DT6/bd4Y4
Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan antivm
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- Contacts a large (2199) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4