Overview

overview

10

Static

static

10

c76b11be6f...kes118

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    0s
  • max time network
    133s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    05/04/2024, 01:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c76b11be6fdeb10b7fccd678b42a7c97_JaffaCakes118

  • Size

    2.5MB

  • MD5

    c76b11be6fdeb10b7fccd678b42a7c97

  • SHA1

    e205276a72a6ae17adac5a4ed10123117e5a4e0f

  • SHA256

    0dcfa54a7e8a4e631ef466670ce604a61f3b0e8b3e9cf72c943278c0f77c31a2

  • SHA512

    1fc1ea1acd43d43fd4ee5b2d362246db95a36b16b3fa66c79466d96115a2c265f6b61602aa74e2f15e1aeef0bfa47ce6826bd7088ec53908cc5f103408d72a65

  • SSDEEP

    49152:oIgrtR1Vl3vrk0c6wOu4hMs9jvlOQhmRYSoXFIz9MZeaFquFUTf80MGIDY9G:oIYtR1VK0c6wOu4PJ1wYTUA0M2G

Score
10/10
xmrig_linuxantivmminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Changes its process name 1 IoCs
  • Deletes itself 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 2 IoCs
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Enumerates kernel/hardware configuration 1 TTPs 49 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/c76b11be6fdeb10b7fccd678b42a7c97_JaffaCakes118
    /tmp/c76b11be6fdeb10b7fccd678b42a7c97_JaffaCakes118
    1⤵
    • Changes its process name
    • Deletes itself
    • Checks CPU configuration
    • Checks hardware identifiers (DMI)
    • Reads CPU attributes
    • Reads hardware information
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /tmp/.X11-unix/11
    Filesize

    5B

    MD5

    9039319d032a0febf1a9548e8a02b98b

    SHA1

    3a360108f2492e11d9874760dbe30e1d395a2411

    SHA256

    5d7611d5935edd152bfb53cb0eb6050771def03e0a1a6223afb8301109bfd536

    SHA512

    5c123b72972ed5a03987b3e5400f7b5a28836c9dbc1097762567734437f7bb98ebb88633433f414f02601c6fad91176607bb16bf0bf011a9ce71fd4388fba6ee

    Download Submit