ogurexxx open to work
RU EN
← cd ~

ogurexxx@root:~$ file ./dropped/*

Malware autopsy

Bots leave their files in the honeypot. Here they are examined as data: a file is read but never run. The findings come from strings inside the file: indicators, not a verdict.

files analysed: 19 · of them binaries: 14

Unknown file

Text file · 389 B · entropy 5.9 · addresses: 258 · 31.10

a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2

VirusTotal ↗

Looks like XMRig

Linux program · x86-64 · 3.2 MB · entropy 7.5 · addresses: 6 · 31.10

  • mines cryptocurrency
  • downloads more files
  • persists on the system
  • kills rivals
  • packed or encrypted

a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125

VirusTotal ↗

Unknown file

Text file · 1 B · entropy 0.0 · addresses: 4 · 31.10

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

VirusTotal ↗

Looks like XMRig

Linux program · x86-64 · 15.9 MB · entropy 6.4 · addresses: 1 · 31.10

  • mines cryptocurrency
  • DDoS attacks
  • persists on the system
  • kills rivals

a9f54da77d9514467cb0e993ead87fb62d95227a46fba17102771aa3a62304b1

VirusTotal ↗

Looks like XMRig

Linux program · x86-64 · 13.3 MB · entropy 6.4 · addresses: 1 · 31.10

  • mines cryptocurrency
  • DDoS attacks
  • persists on the system
  • kills rivals

0165937bc9d7a0a3572826b2cf7bb2471a61dbe910e25b2799dc3481a8d7eb6e

VirusTotal ↗

Looks like XMRig

Linux program · x86-64 · 28.9 MB · entropy 6.4 · addresses: 1 · 31.10

  • mines cryptocurrency
  • DDoS attacks
  • persists on the system
  • kills rivals

94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00

VirusTotal ↗

Unknown file

Linux program · x86-64 · 64 KB · entropy 5.9 · addresses: 1 · 31.10

d7f98e379c400c13340781ccb65017c000330824ea26680866b9d3e43d641721

VirusTotal ↗

Unknown file

Linux program · ARM · 1.4 MB · entropy 8.0 · addresses: 1 · 31.10

  • packed or encrypted

d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141

VirusTotal ↗

Unknown file

Linux program · AArch64 · 1.6 MB · entropy 8.0 · addresses: 1 · 31.10

  • packed or encrypted

d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e

VirusTotal ↗

Unknown file

Text file · 398 B · entropy 5.9 · addresses: 1 · 31.10

8a68d1c08ea31250063f70b1ccb5051db1f7ab6e17d46e9dd3cc292b9849878b

VirusTotal ↗

Unknown file

Script · 1 KB · entropy 4.9 · addresses: 1 · 31.10

  • downloads more files
  • persists on the system

3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892

VirusTotal ↗

Unknown file

Linux program · x86-64 · 1.9 MB · entropy 8.0 · addresses: 1 · 31.10

  • packed or encrypted

f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987

VirusTotal ↗

How it works: each file gets a SHA-256 hash, type, architecture and entropy (near 8 means compression or encryption), and its strings are matched against a dictionary of indicators. The files themselves are not published. Addresses inside them are not shown.