echobot

General

Target

Oblivion121.sh
Size

1KB
Sample

250329-s8wkaaxrs6
MD5

506ea803fdb2d5a593683fe98fec6f1f
SHA1

f71d6ccbfd48bff6ba7c06a7250e137f5ab75066
SHA256

71451b64fc1acf7e50295e14859f7957966210efb8351a26882f96781aa7c4e1
SHA512

213cf82427a6b073293b65f0745fa5bc95e24c7f684aec2f97b7548d4d099c0a0251f691d4a514818da6ad5b6674c55549eaa960a7ac7e2d28ee391d9d626fc5

Score

10^/10

Malware Config

Targets

- Target
  
  Oblivion121.sh
- Size
  
  1KB
- MD5
  
  506ea803fdb2d5a593683fe98fec6f1f
- SHA1
  
  f71d6ccbfd48bff6ba7c06a7250e137f5ab75066
- SHA256
  
  71451b64fc1acf7e50295e14859f7957966210efb8351a26882f96781aa7c4e1
- SHA512
  
  213cf82427a6b073293b65f0745fa5bc95e24c7f684aec2f97b7548d4d099c0a0251f691d4a514818da6ad5b6674c55549eaa960a7ac7e2d28ee391d9d626fc5
Score

10^/10

echobot mirai botnet defense_evasion discovery trojan antivm
- Detected Echobot
- Echobot
  An updated variant of Mirai which infects a wide range of IoT devices to form a botnet.
  botnet trojan echobot
- Echobot family
  echobot
- Mirai
  Mirai is a prevalent Linux malware infecting exposed network devices.
  botnet mirai
- Mirai family
  mirai
- Contacts a large (169840) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies Watchdog functionality
  Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
  defense_evasion
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4