MB-36b650e50841591ccf295f99cbdc6e61fca14226a14eb4e2510da30a9d6ff162
high
📛 Threat Title
EchoBot: linux-x86
Description
File type: elf. Size: 996392 bytes. Tags: EchoBot, elf. Reporter: abuse_ch. First seen: 2026-11-08 07:52:16.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
36b650e50841591ccf295f99cbdc6e61fca14226a14eb4e2510da30a9d6ff162
IOC database
- Type
- hash_sha256
- Value
36b650e50841591ccf295f99cbdc6e61fca14226a14eb4e2510da30a9d6ff162- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
8400b17b5c511ac7ac912bb63d9252fbc4008564
IOC database
- Type
- hash_sha1
- Value
8400b17b5c511ac7ac912bb63d9252fbc4008564- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
5fabfe084552fa62893b6f2a94a086e6
IOC database
- Type
- hash_md5
- Value
5fabfe084552fa62893b6f2a94a086e6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: elf. Size: 996392 bytes. Tags: elf. Reporter: abuse_ch. First seen: 2026-11-08 07:52:16.
Remediations (10)
-
web:access.redhat.com
CVE Details App This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel's cryptographic interface to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise ...
-
web:access.redhat.com
A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant ...
-
web:aws.amazon.com
AWS is aware of CVE-2026-98432, a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated third-party can send crafted IPv4 TCP packets that carry IP options to an affected listener. This results in a ...
-
web:docs.aws.amazon.com
Learn how to protect Amazon Lightsail instances that use Linux blueprints from CVE-2026-98432, a Linux kernel vulnerability, by installing a kernel update or applying a temporary firewall rule.
-
web:mallory.ai
Echobot is a Mirai-derived botnet malware family first identified in 2019 that compromises Linux -based IoT devices, network appliances, enterprise systems, and industrial control equipment. It builds botnets for distributed denial-of-service attacks and propagates through exploitation of known remote code execution and command injection vulnerabilities, alongside brute-force attempts using ...
-
web:threatfox.abuse.ch
The page below gives you an overview on indicators of compromise associated with elf. echobot . You can also get this data through the ThreatFox API. Database Entry ... Indicators Of Compromise The table below shows all indicators of compromise (IOCs) that are associated with this particulare malware family (max 1000).
-
web:unit42.paloaltonetworks.com
Since October 2019, Unit 42 has been tracking a new ECHOBOT variant with 71 unique exploits, 13 of which haven't been previously seen exploited in the wild prior to this version.
-
web:www.derp.ca
Family profile Echobot is a Mirai-derived botnet malware family that targets Linux -based Internet-of-Things, embedded, and network-connected systems through large-scale exploit-driven propagation. First publicly documented in 2019, it evolved rapidly from variants carrying roughly 18 exploits to later builds incorporating more than 50 and then 71 exploits, reflecting an aggressive expansion of ...
-
web:www.malwarewiki.com
Echobot is the most recent addition to the long lineage of Mirai-derived threats. It emerged in mid-May and was first documented by Palo Alto Networks in an early-June report, then again in a mid-June writeup by researchers at Akamai.
-
web:www.phoronix.com
Linux Fixes Faulty Mitigation Selection For BHI Vulnerability Written by Michael Larabel in Linux Kernel on 8 November 2026 at 06:03 AM EST. Add A Comment This week's batch of x86 fixes have been sent out ahead of the Linux 7.4-rc2 kernel releasing later today.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.