Overview
overview
10Static
static
10xm.gz
windows7-x64
3xm.gz
windows10-2004-x64
7sample.tar
windows7-x64
3sample.tar
windows10-2004-x64
7aarch64
ubuntu-18.04-amd64
6create
ubuntu-18.04-amd64
7create
debian-9-armhf
7create
debian-9-mips
1create
debian-9-mipsel
1hide
ubuntu-18.04-amd64
1hide.c
windows7-x64
3hide.c
windows10-2004-x64
3init
ubuntu-18.04-amd64
3mining
ubuntu-18.04-amd64
6mining
debian-9-armhf
6mining
debian-9-mips
6mining
debian-9-mipsel
6mkcfg
ubuntu-18.04-amd64
1mkcfg
debian-9-armhf
1mkcfg
debian-9-mips
1mkcfg
debian-9-mipsel
1start
ubuntu-18.04-amd64
10start
debian-9-armhf
1start
debian-9-mips
1start
debian-9-mipsel
1x86_64
ubuntu-18.04-amd64
6Analysis
-
max time kernel
4s -
max time network
135s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20/12/2023, 05:19
Behavioral task
behavioral1
Sample
xm.gz
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
xm.gz
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
sample.tar
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
sample.tar
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
aarch64
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
create
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral7
Sample
create
Resource
debian9-armhf-20231215-en
debian-9-armhf
Behavioral task
behavioral8
Sample
create
Resource
debian9-mipsbe-20231215-en
debian-9-mips
Behavioral task
behavioral9
Sample
create
Resource
debian9-mipsel-20231215-en
debian-9-mipsel
Behavioral task
behavioral10
Sample
hide
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
hide.c
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
hide.c
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
init
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
mining
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
mining
Resource
debian9-armhf-20231215-en
debian-9-armhf
Behavioral task
behavioral16
Sample
mining
Resource
debian9-mipsbe-20231215-en
debian-9-mips
Behavioral task
behavioral17
Sample
mining
Resource
debian9-mipsel-20231215-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
mkcfg
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
mkcfg
Resource
debian9-armhf-20231215-en
debian-9-armhf
Behavioral task
behavioral20
Sample
mkcfg
Resource
debian9-mipsbe-20231215-en
debian-9-mips
Behavioral task
behavioral21
Sample
mkcfg
Resource
debian9-mipsel-20231215-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
start
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
start
Resource
debian9-armhf-20231215-en
debian-9-armhf
Behavioral task
behavioral24
Sample
start
Resource
debian9-mipsbe-20231215-en
debian-9-mips
Behavioral task
behavioral25
Sample
start
Resource
debian9-mipsel-20231215-en
debian-9-mipsel
Behavioral task
behavioral26
Sample
x86_64
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
General
-
Target
mining
-
Size
355B
-
MD5
8674ce902ffedf49ae4be47baabcc2c0
-
SHA1
441ecd5d3a928125e10a0b6b19f7eed31cfd4476
-
SHA256
8f93a7dd12dbd84749cb5cf675cd8371bd732655a8d048f269d8e88e8136e2e3
-
SHA512
8428b05454cc9a6ccc3ddea862d9f38b6f10f542ebf6f784b2f7027a985f1adc9bf7c69d3306b6d4d1896af9ec8e7fe1e1d9291c60652c46d7e5126a2d2e3380
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/maps awk File opened for reading /proc/31/stat ps File opened for reading /proc/315/status ps File opened for reading /proc/1140/status ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/1052/cmdline ps File opened for reading /proc/1153/status ps File opened for reading /proc/35/stat ps File opened for reading /proc/198/cmdline ps File opened for reading /proc/519/stat ps File opened for reading /proc/550/cmdline ps File opened for reading /proc/1033/cmdline ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/1156/cmdline ps File opened for reading /proc/30/stat ps File opened for reading /proc/85/status ps File opened for reading /proc/meminfo ps File opened for reading /proc/159/status ps File opened for reading /proc/460/cmdline ps File opened for reading /proc/572/stat ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/960/stat ps File opened for reading /proc/1529/status ps File opened for reading /proc/309/status ps File opened for reading /proc/1084/cmdline ps File opened for reading /proc/1/status ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/233/cmdline ps File opened for reading /proc/707/status ps File opened for reading /proc/954/cmdline ps File opened for reading /proc/1516/stat ps File opened for reading /proc/23/stat ps File opened for reading /proc/168/status ps File opened for reading /proc/1061/stat ps File opened for reading /proc/1144/status ps File opened for reading /proc/1251/cmdline ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/665/status ps File opened for reading /proc/960/cmdline ps File opened for reading /proc/1518/status ps File opened for reading /proc/1299/stat ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/31/status ps File opened for reading /proc/487/status ps File opened for reading /proc/639/cmdline ps File opened for reading /proc/1009/cmdline ps File opened for reading /proc/159/cmdline ps File opened for reading /proc/171/cmdline ps File opened for reading /proc/599/cmdline ps File opened for reading /proc/1033/stat ps File opened for reading /proc/1084/stat ps File opened for reading /proc/1373/stat ps File opened for reading /proc/665/cmdline ps File opened for reading /proc/1324/cmdline ps File opened for reading /proc/1347/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/13/stat ps File opened for reading /proc/165/stat ps File opened for reading /proc/854/stat ps File opened for reading /proc/167/cmdline ps File opened for reading /proc/422/cmdline ps File opened for reading /proc/29/stat ps File opened for reading /proc/165/status ps File opened for reading /proc/478/stat ps -
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/logs mining File opened for modification /tmp/ra.pid Process not Found
Processes
-
/tmp/mining/tmp/mining1⤵
- Writes file to tmp directory
PID:1521 -
/tmp/init/tmp/init2⤵PID:1523
-
-
/bin/unameuname -m2⤵PID:1524
-
-
/tmp/hide./hide -s "sendmail: accepting connections" ./mine2⤵PID:1525
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1526
-
-
/bin/grepgrep "sendmail: accepting connections"2⤵PID:1527
-
-
/bin/grepgrep -v grep2⤵PID:1528
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:1529
-
-
/usr/bin/headhead -12⤵PID:1530
-