xorbot

General

Target

bins.sh
Size

10KB
Sample

250221-c9k7yasrz2
MD5

908f28c4ebdeb696d86b93f4afb9cb73
SHA1

3415ecd1724d4da877740685a580688f56330561
SHA256

dca697bba35dd8ce268263754e049b79821084c2a0c64ed556c66902721e8619
SHA512

c826bb3910c158b873f9683474c490e9d8b136294af8b3fce33d8ff09bc28ba936424c36614c02f5c067325029b0170c34183f118ed30ca9197f1f17897f2f63
SSDEEP

96:WK/D/f/a/p/Z/uTW6SXA2hUPCNNSLDdowLGipNtsHrfzRzxz2znzjz6cIt9zzRzu:WGlTNtsHr75Zkz36cIv5Zkz3VNtsHrS

Score

10^/10

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  908f28c4ebdeb696d86b93f4afb9cb73
- SHA1
  
  3415ecd1724d4da877740685a580688f56330561
- SHA256
  
  dca697bba35dd8ce268263754e049b79821084c2a0c64ed556c66902721e8619
- SHA512
  
  c826bb3910c158b873f9683474c490e9d8b136294af8b3fce33d8ff09bc28ba936424c36614c02f5c067325029b0170c34183f118ed30ca9197f1f17897f2f63
- SSDEEP
  
  96:WK/D/f/a/p/Z/uTW6SXA2hUPCNNSLDdowLGipNtsHrfzRzxz2znzjz6cIt9zzRzu:WGlTNtsHr75Zkz36cIv5Zkz3VNtsHrS
Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalation trojan antivm
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- Contacts a large (2132) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4