General

  • Target

    bins.sh

  • Size

    10KB

  • Sample

    241206-ft9gdaxpcq

  • MD5

    bb16aa03b235248a5b8ca49064bc0541

  • SHA1

    1416f37175b6a25898c2b15f173d0d986428d2c1

  • SHA256

    a4511dd3d7f2250db349767b183bbe9b181d76811cd4b47ac83c260f74151b54

  • SHA512

    b9d5c93f607767c79e30ccc17cbba0477536c3c3afce3a94ddd0a334f417a9bc9ec21fad290110c70e054f18470edce5babbbed62fdf405219cc7dcc52ae8285

  • SSDEEP

    192:uf0GJGxGIlh+BPdPjv/ObPjroGJGxGIlhgX:uf0Q80BPdPjv/ObPjroQ8WX

Malware Config

Targets

    • Target

      bins.sh

    • Size

      10KB

    • MD5

      bb16aa03b235248a5b8ca49064bc0541

    • SHA1

      1416f37175b6a25898c2b15f173d0d986428d2c1

    • SHA256

      a4511dd3d7f2250db349767b183bbe9b181d76811cd4b47ac83c260f74151b54

    • SHA512

      b9d5c93f607767c79e30ccc17cbba0477536c3c3afce3a94ddd0a334f417a9bc9ec21fad290110c70e054f18470edce5babbbed62fdf405219cc7dcc52ae8285

    • SSDEEP

      192:uf0GJGxGIlh+BPdPjv/ObPjroGJGxGIlhgX:uf0Q80BPdPjv/ObPjroQ8WX

    • Detects Xorbot

    • Xorbot

      Xorbot is a linux botnet and trojan targeting IoT devices.

    • Xorbot family

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (1966) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Renames itself

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

MITRE ATT&CK Enterprise v15

Tasks