Bb.txt 💯

Unlike common malware that uses random strings, BusyGasper used a deceptively simple naming convention for its components on the infected device's FTP server. Among a list of system-looking files like privapp.txt and supersu.cfg , was found to be a BusyBox v1.26.2 ELF file . By masquerading as a text file, bb.txt aimed to:

The Dual Life of bb.txt: From Generic Placeholder to Spyware Signature bb.txt

Leaving generic files like bb.txt on a production server can create "noise" that makes it easier for actual malware to hide in plain sight. Bash Pattern Matching (Part 2) - Alex's Blog Unlike common malware that uses random strings, BusyGasper