xmrig

General

Target
cfg.zip
Size 6.7MB
Sample230908-mn992sag75
SHA256 412b3a62071a324c8aed31df05c70a774f43f4b8b9904977316890dbae3cba84
MD5 7aab2443a6c5944638331a85a7ffa6cc
SHA1 bb30ab95f9803886beb5457450c6bb62d598292d
SHA512 df0d2dde4200897e3d35f2c5436361d1433ffadcd02fb6a2d6247bd4bb57c684e58f9dcb24459b5af5971395889b441ac136b3f07cd125f4cb650ae19795a712
SSDEEP 98304:HPUf8UA0bYlm8+v/Ex+1ImcYdVnztnUum2K/UN8OyKlP7AyGVWrduQ/moEIA2jRO:HC8UAuYlB+v/3mmPdLng2YKIQ/m6GF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  cfg/dealer
- Size 872KB
- SHA256 fe4c12ea0fae71c7c47dd41a7aef6358803741c3a4b4c3df40245ae466b034ce
- MD5 7a606baa09866fa791d0372eabd4d677
- SHA1 cd8bfebb3318e4cf32428024b28aa4da5ae8355c
- SHA512 eb03d2ec789e1854e1cd01f01b6fcd7b0bf0bb4574f4eda435fc80b723db9bdbbeee7620127e63d18d4d9f9dc1ae9d0936fb8732fa235ce61e5fb20c8838ff11
- SSDEEP 12288:4+vf8LxrsB+yMd0pG6MD5ys/lr2WvnailTJkSyouVV:Fvf8+BdMdEG6M31ZPTTJVGj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig miner persistence
- XMRig Miner payload
  miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies the dynamic linker configuration file
  Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
  persistence
- Adds new SSH keys
  Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
  persistence
- Modifies password files for system users/ groups
  Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Adds a user to the system
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  persistence
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence
- Reads CPU attributes
- Write file to user bin folder
behavioral1
- Target
  cfg/libextrasshd.so
- Size 12KB
- SHA256 7c2dbc1e2177224ae741d001785595e2f5b470181a3525a3cd4a8bc49aedf640
- MD5 fea788309d4360279b242f0ff3540a55
- SHA1 474b9a366cd1a058446d298cb66a3f4a24cd0287
- SHA512 99a74c8ddd4056ba7de6c7e8422cd0187e64f5198450fbdc8c262d739072e9376203084f37a45408d48cffb165c177e411f734560d4b5e5290074a763b17ba9d
- SSDEEP 96:RRYMBWBP9SElNDYyGz/+/T/zk/DtRwlK/vBf1lU0sUEpU7gguBDWBAL+ahyynu:RR58pIElNkvz2bAZRkKhf1ltbu1WSi
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  cfg/player
- Size 1.0MB
- SHA256 c45de89cbafa7e451b7b53fe3eeab0d8c89d82021e1756ba365c852f6b9fe82a
- MD5 accaf477e724abe094f02f38a8ac0d50
- SHA1 33eadd63fa0837c21075106148f27b54f9995424
- SHA512 8b627135156f476df5810b2352a97537286eda4257f5088678e500aad3ebe1e19eab308f1b692e238dcdbf3036444abf74b62e463544cc085fe0ef8b152ee615
- SSDEEP 12288:S8uHrwOFF8mEYM5uT5yUeZF3mAs0HImyU7J/Qs1MK5kRrlNB9EoT:S8erwO/8m85uT5yUAF3mz0N/QX5xNB9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig_linux antivm miner persistence rootkit
- XMRig Miner payload
  miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Modifies the dynamic linker configuration file
  Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
  persistence
- Executes dropped EXE
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Writes DNS configuration
  Writes data to DNS resolver config file.
- Checks CPU configuration
  Checks CPU information which indicate if the system is a virtual machine.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads CPU attributes
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
- Write file to user bin folder
behavioral3
- Target
  cfg/rcu_tasked
- Size 6.3MB
- SHA256 c91824435626f722a1498985317c2f98df43097051eaa916dd01b949392ef8f1
- MD5 ed8ce909d5b90edae8828c6ec648f893
- SHA1 a953a57084e40a38a6d72f7d17e326c4e1cb9cdf
- SHA512 d5b380c26055c6075557b9cc4c2ca5990f60d9bdb5505c2152b9c67af48a32cdba024ae9c2862b7b986f0905389d77fe3f2147be9bc18e5008105c1259dc2126
- SSDEEP 98304:0oOKJTb2IYHD0aIfj7Cu2uquoaZePERGcmT3gFAZxdkiUQLAhixZLQ1W2Be4mRKm:14tag4HZMsCvDZMA
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig_linux antivm miner rootkit
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Checks CPU configuration
  Checks CPU information which indicate if the system is a virtual machine.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Reads CPU attributes
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
behavioral4