Analysis
- max time kernel
153s - max time network
153s - platform
linux_amd64 - resource
ubuntu1804-amd64-en-20211208 - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
08/09/2023, 10:37
Behavioral task
behavioral1
Sample
cfg/dealer
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
cfg/libextrasshd.so
Resource
ubuntu1804-amd64-20230831-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
cfg/player
Resource
ubuntu1804-amd64-20230831-en
ubuntu-18.04-amd64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
cfg/rcu_tasked
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
8 signatures
150 seconds
General
- Target cfg/rcu_tasked
- Size 6.3MB
- Sample230908-mn992sag75
- SHA256 c91824435626f722a1498985317c2f98df43097051eaa916dd01b949392ef8f1
- MD5 ed8ce909d5b90edae8828c6ec648f893
- SHA1 a953a57084e40a38a6d72f7d17e326c4e1cb9cdf
- SHA512 d5b380c26055c6075557b9cc4c2ca5990f60d9bdb5505c2152b9c67af48a32cdba024ae9c2862b7b986f0905389d77fe3f2147be9bc18e5008105c1259dc2126
- SSDEEP 98304:0oOKJTb2IYHD0aIfj7Cu2uquoaZePERGcmT3gFAZxdkiUQLAhixZLQ1W2Be4mRKm:14tag4HZMsCvDZMA
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
ioc pid Process /lib/modules/4.15.0-161-generic/kernel/arch/x86/kernel/msr.ko 610 modprobe - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo rcu_tasked - Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/sys_vendor rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/product_name rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/board_vendor rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/bios_vendor rcu_tasked - Reads CPU attributes 1 TTPs 45 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity rcu_tasked File opened for reading /sys/devices/system/cpu/possible rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets rcu_tasked File opened for reading /sys/devices/system/cpu/online rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map rcu_tasked File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus rcu_tasked - Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_serial rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/board_name rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/product_version rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/chassis_type rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/chassis_serial rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/board_version rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/bios_version rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/board_serial rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/chassis_version rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/bios_date rcu_tasked File opened for reading /sys/devices/virtual/dmi/id/product_uuid rcu_tasked - Enumerates kernel/hardware configuration 1 TTPs 24 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency rcu_tasked File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages Process not Found File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages Process not Found File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems rcu_tasked File opened for reading /sys/devices/system/cpu rcu_tasked File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages rcu_tasked File opened for reading /sys/devices/system/node/node0/cpumap rcu_tasked File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages rcu_tasked File opened for reading /sys/devices/system/node/node0/access1/initiators rcu_tasked File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth rcu_tasked File opened for reading /sys/firmware/dmi/tables/smbios_entry_point Process not Found File opened for reading /sys/fs/cgroup/unified/cgroup.controllers rcu_tasked File opened for reading /sys/devices/system/node/online rcu_tasked File opened for reading /sys/devices/system/node/node0/access0/initiators rcu_tasked File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth rcu_tasked File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency rcu_tasked File opened for reading /sys/devices/virtual/dmi/id rcu_tasked File opened for reading /sys/firmware/dmi/tables/DMI Process not Found File opened for reading /sys/module/msr/initstate modprobe File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus rcu_tasked File opened for reading /sys/devices/system/node/node0/meminfo rcu_tasked File opened for reading /sys/devices/system/node/node0/hugepages rcu_tasked File opened for reading /sys/bus/dax/devices rcu_tasked File opened for reading /sys/kernel/mm/hugepages rcu_tasked - Reads runtime system information 6 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/meminfo rcu_tasked File opened for reading /proc/driver/nvidia/gpus rcu_tasked File opened for reading /proc/meminfo Process not Found File opened for reading /proc/cmdline modprobe File opened for reading /proc/mounts rcu_tasked File opened for reading /proc/self/cpuset rcu_tasked
Processes
-
/tmp/cfg/rcu_tasked/tmp/cfg/rcu_tasked1⤵
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:597
-
/bin/shsh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"1⤵PID:609
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"2⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:610
-