xmrig_linux | eecd1655817b07b4dcf843951be0b9e642c119eadd62bc118bb1fd82aa51aa1c

General

Target

adxintrin_b
Size

241KB
Sample

240320-j4hcescd94
MD5

0e51f9a53fb48add6d175fb559d0bad4
SHA1

0eb71ce8dd1e51da43daf4489a9dc8073e37d62c
SHA256

eecd1655817b07b4dcf843951be0b9e642c119eadd62bc118bb1fd82aa51aa1c
SHA512

91276db9ac0517dad59cccb5608107fb95f55ca2e402b8d8ef91096a3f95c8322ba2fd5938b8b83b9f8d7a72d668298739bd494061073862cdeb11e4f6724190
SSDEEP

3072:Joc9NUyVPo4WTLVCZ+5YygA9+HNqITq0HVOedH0O2l9+hoAlUhPu+:ic9XVPo4WTLVCZ+5YJRtlUhPu+

Score

10^/10

Malware Config

Targets

- Target
  
  adxintrin_b
- Size
  
  241KB
- MD5
  
  0e51f9a53fb48add6d175fb559d0bad4
- SHA1
  
  0eb71ce8dd1e51da43daf4489a9dc8073e37d62c
- SHA256
  
  eecd1655817b07b4dcf843951be0b9e642c119eadd62bc118bb1fd82aa51aa1c
- SHA512
  
  91276db9ac0517dad59cccb5608107fb95f55ca2e402b8d8ef91096a3f95c8322ba2fd5938b8b83b9f8d7a72d668298739bd494061073862cdeb11e4f6724190
- SSDEEP
  
  3072:Joc9NUyVPo4WTLVCZ+5YygA9+HNqITq0HVOedH0O2l9+hoAlUhPu+:ic9XVPo4WTLVCZ+5YJRtlUhPu+
Score

10^/10

xmrig_linux miner persistence
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Modifies the dynamic linker configuration file
  Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
  persistence
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads CPU attributes
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

1

T1574

Privilege Escalation

Hijack Execution Flow

1

T1574

Defense Evasion

Hijack Execution Flow

1

T1574

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

xmrig

Modifies the dynamic linker configuration file

Attempts to change immutable files

Enumerates running processes

Reads CPU attributes

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4