xorbot

General

Target

bins.sh
Size

10KB
Sample

250221-dj4r2a1qar
MD5

55f10153bf7837f1b358e78a9f1cbc72
SHA1

53ce0ffad117ff88767edef40ab1942e43a9b356
SHA256

4d5b35e73e3232fda6c684611138b362138c1e55a6d28efeab85191976eef6e9
SHA512

806df1e0034aec45a4b1efee06f39934e46ef14b98712773bd74a4bb981552169b40748cb78efe0d55ba5c7987e750715d964dfeaa5c700fdc0c5629a7538b92
SSDEEP

96:YRJRLu/Yu/Uu/a/p/Z/uUgcAu1K1C1XA2hEaSlPCD9D9DSLDLpip6pLGi5nFnlnT:6ORLJpsHr3lFkz36QkjlFkz39JpsHrS

Score

10^/10

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  55f10153bf7837f1b358e78a9f1cbc72
- SHA1
  
  53ce0ffad117ff88767edef40ab1942e43a9b356
- SHA256
  
  4d5b35e73e3232fda6c684611138b362138c1e55a6d28efeab85191976eef6e9
- SHA512
  
  806df1e0034aec45a4b1efee06f39934e46ef14b98712773bd74a4bb981552169b40748cb78efe0d55ba5c7987e750715d964dfeaa5c700fdc0c5629a7538b92
- SSDEEP
  
  96:YRJRLu/Yu/Uu/a/p/Z/uUgcAu1K1C1XA2hEaSlPCD9D9DSLDLpip6pLGi5nFnlnT:6ORLJpsHr3lFkz36QkjlFkz39JpsHrS
Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalation trojan antivm
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (1804) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalation
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4