MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 869eafa44fc7263d27e09a18f0f94e1822844ec809f8585baa2ff8a9bd3460b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Xorbot

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	869eafa44fc7263d27e09a18f0f94e1822844ec809f8585baa2ff8a9bd3460b6
SHA3-384 hash:	e25b7e8a09902621123da181242a8b5fada827e8cf9ff2b232308dc89b3e9709cfbaa78eba7e45ba0bcc28f518a393e5
SHA1 hash:	b9b160032f6f5d31ed06c87a2ed126616db6aa15
MD5 hash:	e58b2a8b6f553e7dde48609be8e803f6
humanhash:	magnesium-bravo-spring-minnesota
File name:	bins.sh
Download:	download sample
Signature	Xorbot Create hunting rule
File size:	10'494 bytes
First seen:	2025-02-22 13:06:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:DFUfTeppknsAL+mhmcb1SIYLqOq6sAL+mqIYLqOqsV4fTeppi:DFUfTeppknsAL+mhmcb1SIYLqOrsAL+K
TLSH	T13122D1CC124320AB1740FEBA76E25864A51390C1BEE18B558CEC98ED85CCF8E356ED7D
Magika	shell
Reporter	abuse_ch
Tags:	sh Xorbot

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://37.44.238.88/bins/bEadRflbug3CeDDYYrhlv6ivyofw79rdPb	54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/6DHLvujxkh7tV7WTCiBGtOLzb2nkiJaQcZ	bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/wNhcayxWxwj77Ycj6HO90OEOweLVGe1Fms	0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/Zjvu4MHe7dqjRuxAVuj9ZrueIDrfEPeXnn	2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/wmL4SYaK9OCi8dsGCVavQ6KZMuAkwx1EO8	043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/AKCZ3BuDMnIG9MVNPFb3aAcUqSr8o5GMlD	68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/oEj6D7dVhC4fWg0NCJ7cxemOtWcXj4IVCP	dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/xBSx2GXgF3bigflAg49jP4Q4fnm5IyexNd	94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/IporLAIXaFWMwdJMvf7VFnLPEhq96lphiQ	78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/ySbhNtTCir7w1GeLWg4T0Z4tmETzglv06b	2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/4W0WQvuPngUre004NLtQEW4gmqs22CBQTY	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/PhcmNmeWCmVu6wlW68BSc6I0RjnGRSb68Y	ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/2dOn7QEbnp4mn3A3HIhrAat8tNZ3xxa8tn	dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47	Mirai	elf mirai Xorbot
http://37.44.238.88/bins/rAipJMM6vLQkhcYFjtf7cSn8v7uPaf4Mpd	8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579	Mirai	elf mirai Xorbot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Sanesecurity.Malware.30787.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b9cc0228ab76d43a5c635blinux22vpnfull_triage

Tags:

shellcode agent virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/67b9cc033afc3763bec13fc6/reports/69d3532a-686a-4e44-8489-432073e03d08/overview

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/869eafa44fc7263d27e09a18f0f94e1822844ec809f8585baa2ff8a9bd3460b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/869eafa44fc7263d27e09a18f0f94e1822844ec809f8585baa2ff8a9bd3460b6/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-02-22 13:07:12 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q2pk7jcpy4td2j7atimpb6kodariitwibh4fqw5kf74ktpjumc3a._file

Result

Malware family:

xorbot

Score:

10/10

Tags:

family:xorbot antivm botnet defense_evasion discovery execution linux persistence privilege_escalation trojan

Link:

https://tria.ge/reports/250222-qcnhpaxkcm/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (2164) amount of remote hosts

Creates a large amount of network flows

Detects Xorbot

Xorbot

Xorbot family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/869eafa44fc7263d27e09a18f0f94e1822844ec809f8585baa2ff8a9bd3460b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.