Overview

overview

10

Static

static

7

.rsync/a/a

ubuntu-18.04-amd64

10

.rsync/a/a

debian-9-armhf

10

.rsync/a/a

debian-9-mips

7

.rsync/a/a

debian-9-mipsel

7

.rsync/a/init0

ubuntu-18.04-amd64

6

.rsync/a/init0

debian-9-armhf

6

.rsync/a/init0

debian-9-mips

6

.rsync/a/init0

debian-9-mipsel

6

.rsync/a/kswapd0

ubuntu-18.04-amd64

10

.rsync/a/run

ubuntu-18.04-amd64

3

.rsync/a/run

debian-9-armhf

3

.rsync/a/run

debian-9-mips

3

.rsync/a/run

debian-9-mipsel

3

.rsync/a/stop

ubuntu-18.04-amd64

10

.rsync/a/stop

debian-9-armhf

10

.rsync/a/stop

debian-9-mips

6

.rsync/a/stop

debian-9-mipsel

6

.rsync/b/a

ubuntu-18.04-amd64

7

.rsync/b/a

debian-9-armhf

7

.rsync/b/a

debian-9-mips

6

.rsync/b/a

debian-9-mipsel

7

.rsync/b/run

ubuntu-18.04-amd64

7

.rsync/b/run

debian-9-armhf

7

.rsync/b/run

debian-9-mips

7

.rsync/b/run

debian-9-mipsel

7

.rsync/b/stop

ubuntu-18.04-amd64

6

.rsync/b/stop

debian-9-armhf

6

.rsync/b/stop

debian-9-mips

6

.rsync/b/stop

debian-9-mipsel

6

.rsync/c/blitz

ubuntu-18.04-amd64

1

.rsync/c/blitz

debian-9-armhf

1

.rsync/c/blitz

debian-9-mips

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46.101.121.35-dota3.tar.gz

  • Size

    4.2MB

  • Sample

    240307-wmhyvahf66

  • MD5

    26abd4d721b3f566d47a487838ef288c

  • SHA1

    1bbbde17c6e8c31e3432a6b13bd73bafa6be8c7f

  • SHA256

    105e32c8ef13d4d001923c1a43a8849d069fc4adebe48e5e6a9e726eb605ce31

  • SHA512

    1afcda0d65cdec5fef72a8e800e7373abcd993ee9a874fdf9ced7c1fdcdd9ae613dc2ecb2da437c8b62c418e73c0e1647190f29a0d0bdc7618d4c905327a0a28

  • SSDEEP

    98304:sZ4TV9IbELYtHQ/zyZ9Pv8xkUQSeWRwgQg6NxT0Jk2TFGy0:sZUV9US/g9Pv8OUVLQg6vwm2TFGy0

Score
10/10
xmrig_linuxantivmlinuxminerrootkitupx

Malware Config

Targets

    • Target

      .rsync/a/a

    • Size

      2KB

    • MD5

      b067abc476505eea79d2233ee3585626

    • SHA1

      15f7c9af535f4390b14ba03ddb990c732212dde8

    • SHA256

      ed9330e1594e73097dc6c8bf9f157de0d3799171a1967aaa43f9cd8629092f07

    • SHA512

      95211823aadc69ca8145339188cf90094afb28948ec8729fd4e208fdb0bff4fa3a5435574a12c51618c87916e3ecccfa8c4621b4e6f26c8c42ec8dd13a285fab

    Score
    10/10
    xmrig_linuxantivmminerrootkit

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Executes dropped EXE

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral1behavioral2behavioral3behavioral4

    • Target

      .rsync/a/init0

    • Size

      9KB

    • MD5

      019e23027bc3849142dd8625451ed5c0

    • SHA1

      982c0318414c3fdf82e3726c4ef4e9021751bbd9

    • SHA256

      0e8472f2005560c6f4db4e5aef39e5d35185b35c67f70a27c8b3dcb242eed25e

    • SHA512

      89fd143e3060669df59feeb599cb5042bf8996983dd9073a53cf1d00d408ec9930e1ce29a1aa3aa1f1157a3a6dee1a0cc32f0791c92f75ed0f74c59f326cdc32

    • SSDEEP

      96:97gXuXeR7P0YQH8h9GVQbxgeJwI222bznGWDKKFZ5W:97xeRb038hAGbxIz9/0

    Score
    6/10

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral5behavioral6behavioral7behavioral8

    • Target

      .rsync/a/kswapd0

    • Size

      2.1MB

    • MD5

      8da798989b6e48fb211674b652119a8c

    • SHA1

      ffe36761ebc571f086d06e8a3b5cb3adc5ce8deb

    • SHA256

      8acfbcd3da37b25ae2f2d88115c4b1b05c75e2e9face918e3f21fa10cc3126b4

    • SHA512

      1859b99e1cfa246807d51cec8441b00d0a21251d46198a92b10e7bcf3a4d764a48ba54953da2d79cdbb2d9e29d95d2a6c86c2a34e0968409dbedf9baff807f3b

    • SSDEEP

      49152:XNcjlR90c88OeWSUiyLspBFLKb52pzTduYRSt4rxIugUWsfCfbws:9WPQheWvi9TKV29TdjxICWeCTws

    Score
    10/10
    xmrig_linuxantivmminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral9

    • Target

      .rsync/a/run

    • Size

      109B

    • MD5

      623f15febc9933354a6a08543ae49aa3

    • SHA1

      8b865eb9b747207160a6b5ff1aefad4fbc6fc465

    • SHA256

      1a0391e55d19ec582410044bf2ddaaaea7cf1277d23a8d26b0443bb8e40fa672

    • SHA512

      e1e048b28175eabef7aa5284cae83e44fba7438b72beeddc80c5e39a3b8adf03492ef90090d1fab84b509959fab4e3dd33ad66827c5759a3e9c451429c60bdc6

    Score
    3/10
    behavioral10behavioral11behavioral12behavioral13

    • Target

      .rsync/a/stop

    • Size

      703B

    • MD5

      ff77f6a6f72a80258f484c99fdeb4626

    • SHA1

      36aa94b0ca1ced83d1a24f954f7e2113727797ef

    • SHA256

      d3bf59b23ca07761b6a13739894fec5516a47e388ea3cae9f54a076c0be81c54

    • SHA512

      4f18f5e91f2c791b27d5121a852f7457ba6c3e5193b510868dc412325978a96a60b303c0c1713fc13856c8827a39ee1c0476fb19b397f59a474e13b0896c003d

    Score
    10/10
    xmrig_linuxminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral14behavioral15behavioral16behavioral17

    • Target

      .rsync/b/a

    • Size

      157B

    • MD5

      17dfec62acb9bc298bb333fbe391f486

    • SHA1

      960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795

    • SHA256

      dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920

    • SHA512

      21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881

    Score
    7/10

    • Changes its process name

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral18behavioral19behavioral20behavioral21

    • Target

      .rsync/b/run

    • Size

      72KB

    • MD5

      6ab073e5a6183bcef1d5262a9616ebfe

    • SHA1

      f6ffce31ffff78c28c3485255571459fce17a09e

    • SHA256

      d7a659b2af55a17679e84654ba42d483a0cf5a9e237c7dd5a1dc1976678fa542

    • SHA512

      884ff3c43ec10010b368c03696cbcc47fa9f84ca18658bb20ebdefd82282079027096526561db71cdac38c905d730fa02925294e864128f3be237e307ea1235b

    • SSDEEP

      768:Erk30DgUjDjpk88P1HkEssrOZOHVeu0BlGc67Bkezl5DTwHpohGTW2Zi+GvMKRa7:EfbpT8PqfZOHV2lyG6dkLpUqE3VuQz7a

    Score
    7/10

    • Changes its process name

    behavioral22behavioral23behavioral24behavioral25

    • Target

      .rsync/b/stop

    • Size

      1KB

    • MD5

      5b64a3f14ef56f67c17f9ecfc78cde9f

    • SHA1

      e6892ed68fa1db2ba7b84d3f690ff29eae3dc6c7

    • SHA256

      20eca3e02cc4768498aa34f3161394875808b2c174388292f8d17c90f98e2373

    • SHA512

      4f711c1d1bf81925125cffa0b68e02e9c5162f6fe38bed241d52dab439b4493246eea80e70e0c92bae978f1c347c51965332183930ea2f0a52bbffdcb36b7487

    Score
    6/10

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral26behavioral27behavioral28behavioral29

    • Target

      .rsync/c/blitz

    • Size

      190B

    • MD5

      a6db39f3ee5274c2d0fe55638cad5f19

    • SHA1

      0f7ea48d877572f08d50ddbb548baf04c7095201

    • SHA256

      4fe771908707d2eb526f9928be231b35b972efa3ccb280362ae1a18b6010ceb1

    • SHA512

      fc1a0493b063cac7fe23acc2998a9729d2fa006f11206d2ff1037a234a48dc985c21989d80643953125b527027f1caf831ad7da3a163f84186d307f0b76e5dd8

    Score
    1/10
    behavioral30behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

xmrig_linuxantivmminerrootkit
Score
10/10

behavioral2

xmrig_linuxantivmminer
Score
10/10

behavioral3

Score
7/10

behavioral4

Score
7/10

behavioral5

Score
6/10

behavioral6

Score
6/10

behavioral7

Score
6/10

behavioral8

Score
6/10

behavioral9

xmrig_linuxantivmminer
Score
10/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

Score
3/10

behavioral14

xmrig_linuxminer
Score
10/10

behavioral15

xmrig_linuxminer
Score
10/10

behavioral16

Score
6/10

behavioral17

Score
6/10

behavioral18

Score
7/10

behavioral19

Score
7/10

behavioral20

Score
6/10

behavioral21

Score
7/10

behavioral22

Score
7/10

behavioral23

Score
7/10

behavioral24

Score
7/10

behavioral25

Score
7/10

behavioral26

Score
6/10

behavioral27

Score
6/10

behavioral28

Score
6/10

behavioral29

Score
6/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10