Overview

overview

10

Static

static

10

kM4SUzCwEz...9SyQbw

android-11-x64

kM4SUzCwEz...9SyQbw

android-13-x64

kM4SUzCwEz...9SyQbw

debian-9-armhf

8

Resubmissions

25/03/2025, 12:36

250325-ps2jtazls7 10

07/02/2025, 09:42

250207-lpcvhawrbx 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    kM4SUzCwEzLqZpTJHEAML2NCRRvn9SyQbw

  • Size

    141KB

  • Sample

    250207-lpcvhawrbx

  • MD5

    3ca8decdb1e52c423c521bfff02ac200

  • SHA1

    8621ecd6807109b8541912ad9e134f6fb49bfd48

  • SHA256

    dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

  • SHA512

    b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

  • SSDEEP

    3072:h2mQRJQqJ3OuMP2Q72katWmUd4jEJ/SL06gO0NmmytHHQRkLCalY:h2Y17zaPnEJ/SL16mmytHHQRkLplY

Score
10/10
xorbotandroidbotnetdiscoveryexecutionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      kM4SUzCwEzLqZpTJHEAML2NCRRvn9SyQbw

    • Size

      141KB

    • MD5

      3ca8decdb1e52c423c521bfff02ac200

    • SHA1

      8621ecd6807109b8541912ad9e134f6fb49bfd48

    • SHA256

      dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

    • SHA512

      b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

    • SSDEEP

      3072:h2mQRJQqJ3OuMP2Q72katWmUd4jEJ/SL06gO0NmmytHHQRkLCalY:h2Y17zaPnEJ/SL16mmytHHQRkLplY

    Score
    8/10
    discoveryexecutionpersistenceprivilege_escalation

    • Contacts a large (1560) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Renames itself

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      executionpersistenceprivilege_escalation

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks