Overview

overview

10

Static

static

1

start.sh

debian-12-armhf

1

start.sh

debian-12-mipsel

10

start.sh

debian-9-armhf

10

start.sh

debian-9-mips

10

start.sh

debian-9-mipsel

10

start.sh

ubuntu-18.04-amd64

10

start.sh

ubuntu-20.04-amd64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    start.sh

  • Size

    587B

  • Sample

    240320-1gfzhscg61

  • MD5

    60908850cbaa3ea10f537854675c5017

  • SHA1

    ff4713b46e81dbe16a83efd12b0c274ee8f84893

  • SHA256

    3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

  • SHA512

    eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score
10/10
xmrigxmrig_linuxantivmlinuxminerrootkit

Malware Config

Targets

    • Target

      start.sh

    • Size

      587B

    • MD5

      60908850cbaa3ea10f537854675c5017

    • SHA1

      ff4713b46e81dbe16a83efd12b0c274ee8f84893

    • SHA256

      3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

    • SHA512

      eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

    Score
    10/10
    xmrig_linuxminerantivmxmrigrootkit

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7

MITRE ATT&CK Enterprise v15

Tasks