Linux/LuaBot

Forum for analysis and discussion about malware.
Post Reply
ner0x652
Posts: 1
Joined: Tue Jun 21, 2016 7:53 am

Linux/LuaBot

Post by ner0x652 » Wed Sep 07, 2016 7:22 am

"Malware Must Die" released a great analysis on a new Linux bot, written in Lua.

http://blog.malwaremustdie.org/2016/09/ ... uabot.html

User avatar
Xylitol
Global Moderator
Posts: 1665
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Contact:

Re: Linux/LuaBot

Post by Xylitol » Wed Sep 07, 2016 8:08 am

You do not have the required permissions to view the files attached to this post.

Ludvig
Posts: 7
Joined: Fri Jan 29, 2016 9:30 am

Re: Linux/LuaBot

Post by Ludvig » Fri Sep 16, 2016 3:12 pm

i unpacked lua script.

sign gzip )

Code: Select all

.00102018:  1F 8B 08 00-4E BD AC 57-00 03 AC 3C-6B 73 E3 46
You do not have the required permissions to view the files attached to this post.

User avatar
Xylitol
Global Moderator
Posts: 1665
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Contact:

Re: Linux/LuaBot

Post by Xylitol » Sun Sep 18, 2016 11:36 pm

LuaBot: Malware targeting cable modems ~ https://w00tsec.blogspot.com/2016/09/lu ... odems.html

XHR
Posts: 2
Joined: Wed Mar 02, 2016 12:52 pm

Re: Linux/LuaBot

Post by XHR » Sat May 19, 2018 10:35 am

This bot has evolved a lot since, does anyone have a fresh samples?

Report: https://vms.drweb.com/virus/?_is=2&i=15330288
Sandbox: https://detux.org/report.php?sha256=948 ... aa60c1f345

User avatar
Xylitol
Global Moderator
Posts: 1665
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Contact:

Re: Linux/LuaBot

Post by Xylitol » Sun May 20, 2018 5:50 pm

Files from dr.web article you mentioned
You do not have the required permissions to view the files attached to this post.

XHR
Posts: 2
Joined: Wed Mar 02, 2016 12:52 pm

Re: Linux/LuaBot

Post by XHR » Sat Jun 23, 2018 11:22 pm

Thank you very much Xylitol, any chance to obtain these samples?

Code: Select all

5deb17c660de9d449675ab32048756ed
c867d00e4ed65a4ae91ee65ee00271c7
4b8c0ec8b36c6bf679b3afcc6f54442a
889100a188a42369fd93e7010f7c654b
061b03f8911c41ad18f417223840bce0

User avatar
Xylitol
Global Moderator
Posts: 1665
Joined: Sat Apr 10, 2010 5:54 pm
Location: Seireitei, Soul Society
Contact:

Re: Linux/LuaBot

Post by Xylitol » Sun Jun 24, 2018 1:01 am

voila
You do not have the required permissions to view the files attached to this post.

Post Reply