MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a67a3cb487854437d1f43246571f204ef58507deb3c12e795ec32989c0ae0a59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Xorbot

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	a67a3cb487854437d1f43246571f204ef58507deb3c12e795ec32989c0ae0a59
SHA3-384 hash:	c001f229a4c40a80f9adb770f2b54033dcb7c8af69d54dddfec499e53d85cd723f2680feb006ad8babc9fe9aa52fc7b5
SHA1 hash:	16764d79c906e59098ba1b7d4b4fc9e328239629
MD5 hash:	5810c930e4c1450aa8e1546fa781c45e
humanhash:	charlie-lemon-mirror-ack
File name:	bins.sh
Download:	download sample
Signature	Xorbot Create hunting rule
File size:	10'494 bytes
First seen:	2025-05-29 17:41:33 UTC
Last seen:	2025-05-30 05:06:09 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:J1xFmvfS34383x3+3e3jLPkJpgP555R5uFpYJ8Uva22Iwu6mQmfnnLWLiLzm+T8e:J1xFmvfS34383x3+3e3jLPkJpgPbnJJ1
TLSH	T12E22F3D43F807A20548ACE1A6D37DA082B71C58599D32F71E9D8ECAE4CCEE9C715EE50
Magika	shell
Reporter	abuse_ch
Tags:	sh Xorbot

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://141.98.11.82/bins/tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G	dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv	8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E	68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki	ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr	dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX	94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/MDukejRpEVRJtAF8qJOUHxMH7xLDBBSPzA	bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/y4cOM46uRtKFAfg7vowXnJ6sPSo9YtWU4q	2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/wk7VTKwCVeEQJUdhBBXEYBpypx8AKzXuTR	54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/MCWmH8qLGsVQZzvbYfRMovyxDSv25KlH75	78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/j5pF2uRAfRIrxFbSnk6Wcqg8sFoHfAcw0f	043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/7QHC5pMEH9TTTNrssZuZWwCur8ig80hgfa	0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/qLnWV2Qm5TJZwHN7QmPybNRlLE1HphWjfb	2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70	Mirai	elf mirai ua-wget
http://141.98.11.82/bins/ObtRzbXMZ0GLfCR0BK23moxR4k1LgUKj5Q	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Sanesecurity.Malware.30787.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68389cc6668438e362e82554linux22vpnfull_triage

Tags:

agent hype sage

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a67a3cb487854437d1f43246571f204ef58507deb3c12e795ec32989c0ae0a59

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a67a3cb487854437d1f43246571f204ef58507deb3c12e795ec32989c0ae0a59/

Threat name:

Linux.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-05-29 07:06:31 UTC

File Type:

Text (Shell)

AV detection:

11 of 23 (47.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uz5dznehqvcdpupugjdfohzaj32ykb66wpas46k6ymuytqfobjmq._file

Result

Malware family:

xorbot

Score:

10/10

Tags:

family:xorbot antivm botnet defense_evasion discovery execution linux persistence privilege_escalation trojan

Link:

https://tria.ge/reports/250529-v97eaavwet/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Creates a large amount of network flows

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (893) amount of remote hosts

Detects Xorbot

Xorbot

Xorbot family

Malware family:

Xorbot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a67a3cb48785/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a67a3cb487854437d1f43246571f204ef58507deb3c12e795ec32989c0ae0a59

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.