echobot

General

Target

huh.sh
Size

3KB
Sample

241230-h2mnpa1mfn
MD5

05f3e94487bf02c65f08cbed72943ce0
SHA1

db0a369df0887febacb3800f4c6f0b81a1f68351
SHA256

ec46f105b049d6674acbf45639883623f2f1cb3eed50eedb4b0e25a27a7b67e2
SHA512

bff1d19601df17262771b83212db7a2955bf0882637fc2482e26625a09d294e3f46198049307f4fd2c9f46079b5c4eead5ed0ed0d2db2e33dfb14164ef1f6ac3

Score

10^/10

Malware Config

Targets

- Target
  
  huh.sh
- Size
  
  3KB
- MD5
  
  05f3e94487bf02c65f08cbed72943ce0
- SHA1
  
  db0a369df0887febacb3800f4c6f0b81a1f68351
- SHA256
  
  ec46f105b049d6674acbf45639883623f2f1cb3eed50eedb4b0e25a27a7b67e2
- SHA512
  
  bff1d19601df17262771b83212db7a2955bf0882637fc2482e26625a09d294e3f46198049307f4fd2c9f46079b5c4eead5ed0ed0d2db2e33dfb14164ef1f6ac3
Score

10^/10

echobot mirai botnet defense_evasion discovery trojan antivm
- Detected Echobot
- Echobot
  An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
  botnet trojan echobot
- Echobot family
  echobot
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Mirai family
  mirai
- Contacts a large (247893) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4