xorbot

General

Target

bins.sh
Size

10KB
Sample

241211-eyxgya1lcm
MD5

d5c47e004c5ac3cf521c680d4dad8b43
SHA1

56be34877677b2c08b6cc49ff01b95ce5e9648cf
SHA256

d3a14e7d020238cc0859f57fbd1f6cff0c17fed053c79fd637e0686ec4947b9a
SHA512

bc1052f504c227b1d8818f02cb1aaf88e72ad162444d5f676fef4b098a87d57643e77e46956f226a81434590139533bbb0f34610caa118c7fadacdf46202470f
SSDEEP

192:gSPhJKxx/8sUV7IF5wpxHyc+m6tMMHedto3T7y4nln8Q5Wdto3Tny4nln8Q5KsUJ:gS2Uac+m6tMMHty4nln8Q51y4nln8Q56

Score

10^/10

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  d5c47e004c5ac3cf521c680d4dad8b43
- SHA1
  
  56be34877677b2c08b6cc49ff01b95ce5e9648cf
- SHA256
  
  d3a14e7d020238cc0859f57fbd1f6cff0c17fed053c79fd637e0686ec4947b9a
- SHA512
  
  bc1052f504c227b1d8818f02cb1aaf88e72ad162444d5f676fef4b098a87d57643e77e46956f226a81434590139533bbb0f34610caa118c7fadacdf46202470f
- SSDEEP
  
  192:gSPhJKxx/8sUV7IF5wpxHyc+m6tMMHedto3T7y4nln8Q5Wdto3Tny4nln8Q5KsUJ:gS2Uac+m6tMMHty4nln8Q51y4nln8Q56
Score

10^/10

discovery antivm defense_evasion execution persistence privilege_escalatio xorbot botnet trojan
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- Contacts a large (2021) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4