Analysis
- max time kernel
3s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20230831-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/10/2023, 09:22
Behavioral task
behavioral1
Sample
Japanesex
Resource
ubuntu1804-amd64-20230831-en
ubuntu-18.04-amd64
7 signatures
150 seconds
General
- Target Japanesex
- Size 2.6MB
- Sample231003-lb5y5abe39
- SHA256 3a8259d9352ee5afa15a8105a88db1032c6694d73d87c187ed78b45e88575422
- MD5 18b01ae68a8af82e576c199d13af923b
- SHA1 db16facce9fddac9459b6d3fc6d33430ee3abc6d
- SHA512 4f061714b7928808ed54b394beb9d330a352bcecdd98b9af1c3cb16ac399df0eaa536ac80709c08a3a3949678f1adfbf847cb20081ad7e31550d5be85a3eb9ba
- SSDEEP 49152:h+Tr80M107O59Eg60SQiOTA09evI28KiH7J6MyZM/bW/5AJNI:lHsTsPQqHgJZKU5AXI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo Japanesex - Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name Japanesex File opened for reading /sys/devices/virtual/dmi/id/board_vendor Japanesex File opened for reading /sys/devices/virtual/dmi/id/bios_vendor Japanesex File opened for reading /sys/devices/virtual/dmi/id/sys_vendor Japanesex - Reads CPU attributes 1 TTPs 45 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level Japanesex File opened for reading /sys/devices/system/cpu/online Japanesex File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/possible Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity Japanesex File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size Japanesex File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id Japanesex File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map Japanesex File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings Japanesex File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type Japanesex File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id Japanesex - Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/chassis_serial Japanesex File opened for reading /sys/devices/virtual/dmi/id/product_uuid Japanesex File opened for reading /sys/devices/virtual/dmi/id/board_name Japanesex File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag Japanesex File opened for reading /sys/devices/virtual/dmi/id/chassis_version Japanesex File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag Japanesex File opened for reading /sys/devices/virtual/dmi/id/product_version Japanesex File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor Japanesex File opened for reading /sys/devices/virtual/dmi/id/chassis_type Japanesex File opened for reading /sys/devices/virtual/dmi/id/bios_version Japanesex File opened for reading /sys/devices/virtual/dmi/id/board_version Japanesex File opened for reading /sys/devices/virtual/dmi/id/board_serial Japanesex File opened for reading /sys/devices/virtual/dmi/id/bios_date Japanesex File opened for reading /sys/devices/virtual/dmi/id/product_serial Japanesex - Enumerates kernel/hardware configuration 1 TTPs 19 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node/node0/cpumap Japanesex File opened for reading /sys/devices/system/node/node0/hugepages Japanesex File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages Japanesex File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth Japanesex File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus Japanesex File opened for reading /sys/kernel/mm/hugepages Japanesex File opened for reading /sys/devices/system/node/online Japanesex File opened for reading /sys/devices/system/node/node0/meminfo Japanesex File opened for reading /sys/bus/dax/devices Japanesex File opened for reading /sys/devices/system/node/node0/access1/initiators Japanesex File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency Japanesex File opened for reading /sys/devices/system/cpu Japanesex File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency Japanesex File opened for reading /sys/fs/cgroup/unified/cgroup.controllers Japanesex File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages Japanesex File opened for reading /sys/devices/system/node/node0/access0/initiators Japanesex File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth Japanesex File opened for reading /sys/devices/virtual/dmi/id Japanesex File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems Japanesex - Reads runtime system information 5 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/exe Japanesex File opened for reading /proc/mounts Japanesex File opened for reading /proc/self/cpuset Japanesex File opened for reading /proc/meminfo Japanesex File opened for reading /proc/driver/nvidia/gpus Japanesex