Resubmissions

05/12/2024, 20:30

241205-zam9ks1jdz 7

05/12/2024, 18:54

241205-xkdrsaxjh1 10

General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241205-xkdrsaxjh1

  • MD5

    4093468cb289161fafc09f21e68696a4

  • SHA1

    4d7b36f867474e34dc1477e6e25848fad135aab0

  • SHA256

    3f871f6373ed1d96d826cebecafebbe8288f410c1993edad3ef8fd2cd6f087af

  • SHA512

    70ed1f800269587a49d4dad61191089d7cae39499b2cdf9c32a233e99f72bc7dafe883b28b7bf1b86855ed873f6b2ea3930a4a4c85979053dd057b488132a1d8

  • SSDEEP

    192:hjH32uT5nYosu7r4b79UIuACc4O1dNN10Yinosu7rGb79UINjH32u56qc4O1dOND:hjH32uT5nEb79UInN10Yi7b79UINjH3H

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      4093468cb289161fafc09f21e68696a4

    • SHA1

      4d7b36f867474e34dc1477e6e25848fad135aab0

    • SHA256

      3f871f6373ed1d96d826cebecafebbe8288f410c1993edad3ef8fd2cd6f087af

    • SHA512

      70ed1f800269587a49d4dad61191089d7cae39499b2cdf9c32a233e99f72bc7dafe883b28b7bf1b86855ed873f6b2ea3930a4a4c85979053dd057b488132a1d8

    • SSDEEP

      192:hjH32uT5nYosu7r4b79UIuACc4O1dNN10Yinosu7rGb79UINjH32u56qc4O1dOND:hjH32uT5nEb79UInN10Yi7b79UINjH3H

    • Detects Xorbot

    • Xorbot

      Xorbot is a linux botnet and trojan targeting IoT devices.

    • Xorbot family

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks