General
-
Target
bins.sh
-
Size
10KB
-
Sample
241211-sk6eksslck
-
MD5
5eab5295c0740b5344abb66f19ea0e39
-
SHA1
7796e56bc014459c40563c509569791a6f05341a
-
SHA256
b516438a84f4d4febdc19c62bae733ac24bf557205fd8ac1e42d1fb0f83f0d5a
-
SHA512
6922bb223cb1df386c64584feb519299b4e06ed94d6153a314e01a883ecfa5a608bfb4732e11dff85402cdc406fd1293db7914457c14f8024a54f87754afb4d4
-
SSDEEP
96:C//63ZCcEgN6L/vLIPnA43WlMf61Nx//63bZCcEgN8Lv7vLIPnlXXWTyYl6f81Na:dCcEg4BaWuf61PcEgVIQz
Malware Config
Targets
-
-
Target
bins.sh
-
Size
10KB
-
MD5
5eab5295c0740b5344abb66f19ea0e39
-
SHA1
7796e56bc014459c40563c509569791a6f05341a
-
SHA256
b516438a84f4d4febdc19c62bae733ac24bf557205fd8ac1e42d1fb0f83f0d5a
-
SHA512
6922bb223cb1df386c64584feb519299b4e06ed94d6153a314e01a883ecfa5a608bfb4732e11dff85402cdc406fd1293db7914457c14f8024a54f87754afb4d4
-
SSDEEP
96:C//63ZCcEgN6L/vLIPnA43WlMf61Nx//63bZCcEgN8Lv7vLIPnlXXWTyYl6f81Na:dCcEg4BaWuf61PcEgVIQz
Score10/10-
Detects Xorbot
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
Contacts a large (2210) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Renames itself
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1