MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Xorbot

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf
SHA3-384 hash:	0360f33dce6f4ff157a52fc64f580c84a8d5de91b825a188a92a61a7f99694664c681cbc34553ebbcdd72a95c74d3efc
SHA1 hash:	fa41bc59a61d70fed29d83a9fadcaf5f29a0306c
MD5 hash:	2d3354e4454c0aa1442c15ae4db570d7
humanhash:	oxygen-red-magnesium-enemy
File name:	bins.sh
Download:	download sample
Signature	Xorbot Create hunting rule
File size:	10'578 bytes
First seen:	2025-03-13 01:11:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:vT3jmvfO3m3C3x3+3e35BNkJpg35J5B5uFpYb+2va224Gm6eQmp9lLWLqLzm+B+k:vT3jmvfO3m3C3x3+3e35BNkJpg3bvJb7
TLSH	T1B1220DDA1D805AE05581C62E7DF7AEA82853C389ACD2EB51D4EF1CF94C8CEDCB154E60
Magika	shell
Reporter	abuse_ch
Tags:	sh Xorbot

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://77.90.153.218/bins/tCV5vO5tw9z8XJnNLCPzh9rWcP75X3gc4G	dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/59fT4e3UEmL9oGFEi4nhEPDL9v4liwzVzv	8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/l8bIo6MX0E2xzUa8GlxxB3QQT28nJjEe7E	72a283ef2d020d148a1ca602a4fa5b83b9046cb108fabff9807ba5fe3998e3c1	Gafgyt	elf gafgyt mirai ua-wget Xorbot
http://77.90.153.218/bins/1Url4Vmjm3jutDoL4IALrwVcTgwtmfdAki	ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/z9GdbmiPoT1CYXtsXr4DYxGfZQoAwH2Upr	dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/kcZ7wDS9Ey1472EBe1Yh1UdgSWJCDpmXmX	9466891fc7a86c2cd501bb5ef1092b405ba21209ad095a5ad381938e7c33ce6b	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/MDukejRpEVRJtAF8qJOUHxMH7xLDBBSPzA	bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/y4cOM46uRtKFAfg7vowXnJ6sPSo9YtWU4q	2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/wk7VTKwCVeEQJUdhBBXEYBpypx8AKzXuTR	54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/MCWmH8qLGsVQZzvbYfRMovyxDSv25KlH75	da6b20fc4cc13da83aee629774cf25ba36855744efe668a3e5aae81fbd0913e1	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/j5pF2uRAfRIrxFbSnk6Wcqg8sFoHfAcw0f	043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/7QHC5pMEH9TTTNrssZuZWwCur8ig80hgfa	0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/qLnWV2Qm5TJZwHN7QmPybNRlLE1HphWjfb	2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70	Mirai	elf mirai ua-wget Xorbot
http://77.90.153.218/bins/ObtRzbXMZ0GLfCR0BK23moxR4k1LgUKj5Q	5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18	Mirai	elf mirai ua-wget Xorbot

Intelligence

File Origin

# of uploads :

# of downloads :

141

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d23fbcdff6bd921908b200linux22vpnfull_triage

Tags:

gafgyt hajime mirai

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2025-03-13 00:39:33 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u27bfq6i3urvlf27ddn6wrimceyn6uhysnkifavue7cjgpq7cxhq._file

Result

Malware family:

xorbot

Score:

10/10

Tags:

family:xorbot antivm botnet defense_evasion discovery execution linux persistence privilege_escalation trojan

Link:

https://tria.ge/reports/250313-bkkpfay1fy/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Creates a large amount of network flows

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (891) amount of remote hosts

Detects Xorbot

Xorbot

Xorbot family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a6be12c3c8dd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a6be12c3c8dd2355975f18dbeb450c1130df50f893548282b427c4933e1f15cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.