MB-28cd43f5dd1aaf575f067fa9eac5d999ddc26b35c5809d427a6cc137e4713555
high
📛 Threat Title
EchoBot: linux-aarch64
Description
File type: elf. Size: 871984 bytes. Tags: EchoBot, elf. Reporter: abuse_ch. First seen: 2026-11-08 07:52:12.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
28cd43f5dd1aaf575f067fa9eac5d999ddc26b35c5809d427a6cc137e4713555
IOC database
- Type
- hash_sha256
- Value
28cd43f5dd1aaf575f067fa9eac5d999ddc26b35c5809d427a6cc137e4713555- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
c5f8e3a2aa09adcee03016481d508ed684594cb4
IOC database
- Type
- hash_sha1
- Value
c5f8e3a2aa09adcee03016481d508ed684594cb4- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
9cf75cf6be91a6010769815a954d724f
IOC database
- Type
- hash_md5
- Value
9cf75cf6be91a6010769815a954d724f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 871984 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-11-08 07:52:12.
Remediations (10)
-
web:access.redhat.com
A flaw was found in the Linux kernel's netfilter bridge ebtables SNAT (Source Network Address Translation) module. This vulnerability allows a local attacker on a system configured with specific bridge netfilter rules to improperly modify underlying memory pages during an ARP (Address Resolution Protocol) sender hardware address rewrite. This could lead to unintended system behavior, a denial ...
-
web:aws.amazon.com
AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third-party can send crafted IPv4 TCP packets that carry IP options to an affected listener. This results in a ...
-
web:ctiwatch.com
Echobot is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.
-
web:dailysecurityreview.com
Arch Linux pulled three AUR packages after discovering they delivered Chaos RAT malware through a malicious GitHub script, compromising Linux systems via community-sourced PKGBUILD files.
-
web:deepwiki.com
Purpose and Scope This page defines the end-to-end operational workflow for mitigating and patching the Dirty Frag vulnerability class (CVE-2026-43284 and CVE-2026-43500) across supported Linux distributions. It covers initialization prerequisites, logging structures, the 10-phase remediation lifecycle (Phase 0 through Phase 9), and the shared command-line interface design implemented in the ...
-
web:kb.ciq.com
Infinity Core is a collection of six local privilege escalation (LPE) vulnerabilities in the Linux kernel, disclosed on 2026-10-16. The vulnerabilities target…
-
web:mallory.ai
Echobot is a Mirai-derived botnet malware family first identified in 2019 that compromises Linux -based IoT devices, network appliances, enterprise systems, and industrial control equipment. It builds botnets for distributed denial-of-service attacks and propagates through exploitation of known remote code execution and command injection vulnerabilities, alongside brute-force attempts using ...
-
web:unit42.paloaltonetworks.com
Since October 2019, Unit 42 has been tracking a new ECHOBOT variant with 71 unique exploits, 13 of which haven't been previously seen exploited in the wild prior to this version.
-
web:www.derp.ca
Family profile Echobot is a Mirai-derived botnet malware family that targets Linux -based Internet-of-Things, embedded, and network-connected systems through large-scale exploit-driven propagation. First publicly documented in 2019, it evolved rapidly from variants carrying roughly 18 exploits to later builds incorporating more than 50 and then 71 exploits, reflecting an aggressive expansion of ...
-
web:www.malwarewiki.com
Echobot is the most recent addition to the long lineage of Mirai-derived threats. It emerged in mid-May and was first documented by Palo Alto Networks in an early-June report, then again in a mid-June writeup by researchers at Akamai.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.