xorbot | 47bec10be1924a07463c14e3ec14c0d176a1647a2f8090a774b6b9d0317f5b25 | Triage

Submit
Reports

Overview

overview

Static

static

1

bins.sh

ubuntu-18.04-amd64

bins.sh

debian-9-armhf

bins.sh

debian-9-mips

bins.sh

debian-9-mipsel

Sharing

General

Target

bins.sh
Size

10KB
Sample

241201-wzlv9sxqgt
MD5

28b44d48978ad6ce4f2eed068e2680b4
SHA1

36f517d3e46e9e683a46490065c5f2169c47ca6b
SHA256

47bec10be1924a07463c14e3ec14c0d176a1647a2f8090a774b6b9d0317f5b25
SHA512

dee2972f09ac8e1ff184ef0fccb7b4107d55f0324a6907f6af177226a95d48365b48950c06c946c9e6e76f9aa4b9bcbb9fcf185ed4f6844f6b7bfeb341c009a3
SSDEEP

96:h7r7r7p7m7iYx4RrBNFjJUDqRT21WFi6JU1hOY97r7r7p7m7iux4VO:1XXdMfx4RrBNFVYXXdMNWO

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution linux persistence privilege_escalatio trojan

Static task

static1

Behavioral task

behavioral1

Sample

bins.sh

Resource

ubuntu1804-amd64-20240611-en

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan

ubuntu-18.04-amd64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

bins.sh

Resource

debian9-armhf-20240611-en

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalatio trojan

debian-9-armhf

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

bins.sh

Resource

debian9-mipsbe-20240611-en

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan

debian-9-mips

10 signatures

150 seconds

Behavioral task

behavioral4

Sample

bins.sh

Resource

debian9-mipsel-20240226-en

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan

debian-9-mipsel

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  28b44d48978ad6ce4f2eed068e2680b4
- SHA1
  
  36f517d3e46e9e683a46490065c5f2169c47ca6b
- SHA256
  
  47bec10be1924a07463c14e3ec14c0d176a1647a2f8090a774b6b9d0317f5b25
- SHA512
  
  dee2972f09ac8e1ff184ef0fccb7b4107d55f0324a6907f6af177226a95d48365b48950c06c946c9e6e76f9aa4b9bcbb9fcf185ed4f6844f6b7bfeb341c009a3
- SSDEEP
  
  96:h7r7r7p7m7iYx4RrBNFjJUDqRT21WFi6JU1hOY97r7r7p7m7iux4VO:1XXdMfx4RrBNFVYXXdMNWO
Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalatio trojan antivm
- Detects Xorbot
  botnet trojan
- Xorbot
  Xorbot is a linux botnet and trojan targeting IoT devices.
  botnet trojan xorbot
- Xorbot family
  xorbot
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Scheduled Task/Job

Cron

Privilege Escalation

Scheduled Task/Job

Cron

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

xorbotbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

behavioral2

xorbotantivmbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

behavioral3

xorbotbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

behavioral4

xorbotbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

© 2018-2024

Terms | Privacy