TF-MAL-elf.airdrop
📛 Threat Title
Malware family: AirDropBot
Description
ThreatFox malware family `elf.airdrop`. Printable name: AirDropBot. Aliases: CloudBot.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.airdrop
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.airdrop
IOC database
- Type
- domain
- Value
elf.airdrop- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.airdrop
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.airdrop
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.malwaremustdie.org
MalwareMustDie (MMD) is a whitehat workgroup to reduce malware , this blog advocates research on new malware threats & Linux malware .
-
web:ieeexplore.ieee.org
The emergence of Internet of Things malware , which leverages exploited IoT devices to perform large-scale cyber attacks (e.g., Mirai botnet), is considered as a major threat to the Internet ecosystem. To mitigate such threat, there is an utmost need for effective IoT malware classification and family attribution, which provide essential steps towards initiating attack mitigation /prevention ...
-
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
-
web:malpedia.caad.fkie.fraunhofer.de
AirDropBot is used to create a DDoS botnet. It spreads as a worm, currently targeting Linksys routers. Backdoor and other bot functionality is present in this family . Development seems to be ongoing.
-
web:securityaffairs.com
After 2 years of waiting, MalwareMustDie returns with an excellent page of malware analysis of a new IoT malware : Linux/ AirDropBot .
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.crowdstrike.com
Remediate faster Execute built-in commands or custom scripts to easily carry out complex remediation actions on any managed endpoint remotely. Connect to and quickly isolate the impacted endpoint, then remove malicious files to immediately shut down the attack.
-
web:www.sciencedirect.com
The evolution of IoT malware and the effectiveness of defense strategies, e.g., leveraging malware family classification, have driven the development of advanced classification learning models. These models, particularly those that utilize model-extracted features, significantly enhance classification performance while minimizing the need for extensive expert knowledge from developers. However ...
-
web:www.thelinuxmall.com
We have Unixfreaxjp back with a brand new reverse-engineering tool published on the blog of MalwareMustDie, the MMD-0064-2019 - Linux/ AirDropBot is a total work of art in every regard. Technically speaking, we will find some new and improved practices that can help us reverse every single Linux malware binary in all types of environments.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.