General
-
Target
2F2AM_bins.sh
-
Size
10KB
-
Sample
241211-qw8b7syqcq
-
MD5
5487a00d588e2fdee33384c6b9083650
-
SHA1
42d5da8e0c679b5ea93e9de5acb601fd23b68d74
-
SHA256
2c63a569d43b7721befa5dc6c53dc0d804dcc9302c76c9b789eb1a06d2c111fc
-
SHA512
3d9256d28169556b0aad9cd820dc6c931c4d02608aa9749ec56e4ae3e288babc3a1e8553c5982b7998acafb808d0a49f9c296f6ee8e0b2c358c1016730e6866d
-
SSDEEP
192:RfUJYggpIpkktsx4uxlenHOqtx547v+zFFw9Zhkkts3xlq3OqHx547vSFFw9ZvAh:RfD4uxlenj/xlqQW
Malware Config
Targets
-
-
Target
2F2AM_bins.sh
-
Size
10KB
-
MD5
5487a00d588e2fdee33384c6b9083650
-
SHA1
42d5da8e0c679b5ea93e9de5acb601fd23b68d74
-
SHA256
2c63a569d43b7721befa5dc6c53dc0d804dcc9302c76c9b789eb1a06d2c111fc
-
SHA512
3d9256d28169556b0aad9cd820dc6c931c4d02608aa9749ec56e4ae3e288babc3a1e8553c5982b7998acafb808d0a49f9c296f6ee8e0b2c358c1016730e6866d
-
SSDEEP
192:RfUJYggpIpkktsx4uxlenHOqtx547v+zFFw9Zhkkts3xlq3OqHx547vSFFw9ZvAh:RfD4uxlenj/xlqQW
Score10/10-
Detects Xorbot
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
Contacts a large (2141) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Renames itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1