Overview

overview

10

Static

static

7

.rsync/a/a

ubuntu-20.04-amd64

10

.rsync/a/init0

ubuntu-20.04-amd64

6

.rsync/a/kswapd0

ubuntu-20.04-amd64

10

.rsync/a/run

ubuntu-20.04-amd64

3

.rsync/a/stop

ubuntu-20.04-amd64

10

.rsync/b/a

ubuntu-20.04-amd64

7

.rsync/b/run

ubuntu-20.04-amd64

7

.rsync/b/stop

ubuntu-20.04-amd64

6

.rsync/c/blitz

ubuntu-20.04-amd64

1

.rsync/c/blitz32

ubuntu-20.04-amd64

3

.rsync/c/blitz64

ubuntu-20.04-amd64

3

.rsync/c/go

ubuntu-20.04-amd64

3

.rsync/c/run

ubuntu-20.04-amd64

6

.rsync/c/start

ubuntu-20.04-amd64

9

.rsync/c/stop

ubuntu-20.04-amd64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dota3.tar.gz

  • Size

    4.2MB

  • Sample

    240415-tgfkesad73

  • MD5

    26abd4d721b3f566d47a487838ef288c

  • SHA1

    1bbbde17c6e8c31e3432a6b13bd73bafa6be8c7f

  • SHA256

    105e32c8ef13d4d001923c1a43a8849d069fc4adebe48e5e6a9e726eb605ce31

  • SHA512

    1afcda0d65cdec5fef72a8e800e7373abcd993ee9a874fdf9ced7c1fdcdd9ae613dc2ecb2da437c8b62c418e73c0e1647190f29a0d0bdc7618d4c905327a0a28

  • SSDEEP

    98304:sZ4TV9IbELYtHQ/zyZ9Pv8xkUQSeWRwgQg6NxT0Jk2TFGy0:sZUV9US/g9Pv8OUVLQg6vwm2TFGy0

Score
10/10
xmrig_linuxantivmdiscoverylinuxminerupx

Malware Config

Targets

    • Target

      .rsync/a/a

    • Size

      2KB

    • MD5

      b067abc476505eea79d2233ee3585626

    • SHA1

      15f7c9af535f4390b14ba03ddb990c732212dde8

    • SHA256

      ed9330e1594e73097dc6c8bf9f157de0d3799171a1967aaa43f9cd8629092f07

    • SHA512

      95211823aadc69ca8145339188cf90094afb28948ec8729fd4e208fdb0bff4fa3a5435574a12c51618c87916e3ecccfa8c4621b4e6f26c8c42ec8dd13a285fab

    Score
    10/10
    xmrig_linuxantivmminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Executes dropped EXE

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral1

    • Target

      .rsync/a/init0

    • Size

      9KB

    • MD5

      019e23027bc3849142dd8625451ed5c0

    • SHA1

      982c0318414c3fdf82e3726c4ef4e9021751bbd9

    • SHA256

      0e8472f2005560c6f4db4e5aef39e5d35185b35c67f70a27c8b3dcb242eed25e

    • SHA512

      89fd143e3060669df59feeb599cb5042bf8996983dd9073a53cf1d00d408ec9930e1ce29a1aa3aa1f1157a3a6dee1a0cc32f0791c92f75ed0f74c59f326cdc32

    • SSDEEP

      96:97gXuXeR7P0YQH8h9GVQbxgeJwI222bznGWDKKFZ5W:97xeRb038hAGbxIz9/0

    Score
    6/10

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral2

    • Target

      .rsync/a/kswapd0

    • Size

      2.1MB

    • MD5

      8da798989b6e48fb211674b652119a8c

    • SHA1

      ffe36761ebc571f086d06e8a3b5cb3adc5ce8deb

    • SHA256

      8acfbcd3da37b25ae2f2d88115c4b1b05c75e2e9face918e3f21fa10cc3126b4

    • SHA512

      1859b99e1cfa246807d51cec8441b00d0a21251d46198a92b10e7bcf3a4d764a48ba54953da2d79cdbb2d9e29d95d2a6c86c2a34e0968409dbedf9baff807f3b

    • SSDEEP

      49152:XNcjlR90c88OeWSUiyLspBFLKb52pzTduYRSt4rxIugUWsfCfbws:9WPQheWvi9TKV29TdjxICWeCTws

    Score
    10/10
    xmrig_linuxantivmminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Reads CPU attributes

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral3

    • Target

      .rsync/a/run

    • Size

      109B

    • MD5

      623f15febc9933354a6a08543ae49aa3

    • SHA1

      8b865eb9b747207160a6b5ff1aefad4fbc6fc465

    • SHA256

      1a0391e55d19ec582410044bf2ddaaaea7cf1277d23a8d26b0443bb8e40fa672

    • SHA512

      e1e048b28175eabef7aa5284cae83e44fba7438b72beeddc80c5e39a3b8adf03492ef90090d1fab84b509959fab4e3dd33ad66827c5759a3e9c451429c60bdc6

    Score
    3/10
    behavioral4

    • Target

      .rsync/a/stop

    • Size

      703B

    • MD5

      ff77f6a6f72a80258f484c99fdeb4626

    • SHA1

      36aa94b0ca1ced83d1a24f954f7e2113727797ef

    • SHA256

      d3bf59b23ca07761b6a13739894fec5516a47e388ea3cae9f54a076c0be81c54

    • SHA512

      4f18f5e91f2c791b27d5121a852f7457ba6c3e5193b510868dc412325978a96a60b303c0c1713fc13856c8827a39ee1c0476fb19b397f59a474e13b0896c003d

    Score
    10/10
    xmrig_linuxminer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral5

    • Target

      .rsync/b/a

    • Size

      157B

    • MD5

      17dfec62acb9bc298bb333fbe391f486

    • SHA1

      960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795

    • SHA256

      dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920

    • SHA512

      21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881

    Score
    7/10

    • Changes its process name

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral6

    • Target

      .rsync/b/run

    • Size

      72KB

    • MD5

      6ab073e5a6183bcef1d5262a9616ebfe

    • SHA1

      f6ffce31ffff78c28c3485255571459fce17a09e

    • SHA256

      d7a659b2af55a17679e84654ba42d483a0cf5a9e237c7dd5a1dc1976678fa542

    • SHA512

      884ff3c43ec10010b368c03696cbcc47fa9f84ca18658bb20ebdefd82282079027096526561db71cdac38c905d730fa02925294e864128f3be237e307ea1235b

    • SSDEEP

      768:Erk30DgUjDjpk88P1HkEssrOZOHVeu0BlGc67Bkezl5DTwHpohGTW2Zi+GvMKRa7:EfbpT8PqfZOHV2lyG6dkLpUqE3VuQz7a

    Score
    7/10

    • Changes its process name

    behavioral7

    • Target

      .rsync/b/stop

    • Size

      1KB

    • MD5

      5b64a3f14ef56f67c17f9ecfc78cde9f

    • SHA1

      e6892ed68fa1db2ba7b84d3f690ff29eae3dc6c7

    • SHA256

      20eca3e02cc4768498aa34f3161394875808b2c174388292f8d17c90f98e2373

    • SHA512

      4f711c1d1bf81925125cffa0b68e02e9c5162f6fe38bed241d52dab439b4493246eea80e70e0c92bae978f1c347c51965332183930ea2f0a52bbffdcb36b7487

    Score
    6/10

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral8

    • Target

      .rsync/c/blitz

    • Size

      190B

    • MD5

      a6db39f3ee5274c2d0fe55638cad5f19

    • SHA1

      0f7ea48d877572f08d50ddbb548baf04c7095201

    • SHA256

      4fe771908707d2eb526f9928be231b35b972efa3ccb280362ae1a18b6010ceb1

    • SHA512

      fc1a0493b063cac7fe23acc2998a9729d2fa006f11206d2ff1037a234a48dc985c21989d80643953125b527027f1caf831ad7da3a163f84186d307f0b76e5dd8

    Score
    1/10
    behavioral9

    • Target

      .rsync/c/blitz32

    • Size

      1.0MB

    • MD5

      cda7b610c83e09f125599f661d4685bc

    • SHA1

      84f1120a6ff3fa6aa5f0d343d34036db16fa31fb

    • SHA256

      959ede1405a513855ec423b8f7953ea23a750e8b761d2b97eab0f295ed5787e7

    • SHA512

      0fb8cc53222b7deba72677f411d1b6b04f919d8cc938ddac334be412a3a238e41edd0070f597a4b87bb821a0de23801f782a12e1e32c959cbd626fbab9102021

    • SSDEEP

      24576:4FExXyWva34P9DDQFHwMwjxQejfECV9rlHojo/MKapXdnlf:4FAnSI9QFixD7N9rlHOo/MZflf

    Score
    3/10
    behavioral10

    • Target

      .rsync/c/blitz64

    • Size

      1.0MB

    • MD5

      22f42b16687c76f764e81206e43d88b7

    • SHA1

      af06e9759d6bd551261c8440752a20f1cc7305d9

    • SHA256

      91f12a300565ebdb762a988cd52ef42d8ccf9ce9fd2079ea52e398c3a0692ac8

    • SHA512

      0b8317ac50d0b9ee0b4da1b656ac343fb918caebd31c91bc1a3a2e72326cf728c653f86a6f04ca41d18d75011b0e28a8611a911eeaf6289940fc921d003963dd

    • SSDEEP

      24576:zmHiL3gZdPuOpueLzFO7lH/H0BAO78dbReGYzK4C1CIeZHVUD:6HiMZd2O99O7lS58pAzpcCIeZqD

    Score
    3/10
    behavioral11

    • Target

      .rsync/c/go

    • Size

      835B

    • MD5

      a4f62d9468f7d6ae1add3afb1d0e0180

    • SHA1

      d8384cb7977249d1d32e33af68be46da6a0ca3b6

    • SHA256

      74b49d77ca301c5abaffa3826849eff8f8d8be359b77bcff8c8087c828a9b1b4

    • SHA512

      a0d9d354402fa3edcc2753a2c0176e20d183726107a7a3354e0ce1308d39ea2366fe95dd0b5001f6281c90902cb5669c51becf7644be510c2b0f13917b50d582

    Score
    3/10
    behavioral12

    • Target

      .rsync/c/run

    • Size

      489B

    • MD5

      97a962fb5bd427e09547ecaaf850e034

    • SHA1

      3040ea8bc3226af1fc201c4fefcca17b62184bbe

    • SHA256

      5a1797ae845e8c80c771ece9174b93ad5d5a74e593fe3b508ba105830db5fd92

    • SHA512

      2ed6bad217478913a053fbcad37c904dddacee424ce39115c15019477870582b0d53da908783047cf9069df0a011387b3fba336385ff392ab0be84cd49d04001

    Score
    6/10
    antivm

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm
    behavioral13

    • Target

      .rsync/c/start

    • Size

      203B

    • MD5

      ffd387bdf3adab8969941693d3a86ee7

    • SHA1

      3f49c18c7cdcf808882dfd8ca5271e361aaeea00

    • SHA256

      9dbbc9b5d7793425968e42e995226c5f9fe32e502a0a694320a5e838d57c8836

    • SHA512

      e633aecfcb41582bf37d7dbcd0b9423872a4ee99e7049e8a80b23e4ae559444321fb1522690fdd78ad20f6b520bcfa185425216012cedd2ed38ad7d884fb3322

    Score
    9/10
    antivmdiscovery

    • Contacts a large (25961) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Changes its process name

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

      antivm

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral14

    • Target

      .rsync/c/stop

    • Size

      1KB

    • MD5

      94724fcd5b10cefc760d556779a95c75

    • SHA1

      c14a7f5117c04e943b1095d42e5ee4541256c7ee

    • SHA256

      0d72d5059120530da9594adae05739cbf9a830bfc7e82409b5efddea64f27f03

    • SHA512

      e3f17e68ed7c422897680b3e8ca00748af9cdf0d94377cf925164fda5248e9edf9d6888de4205780c8983287526dafed9bc2c6959983736ca119f0b4748d7da5

    Score
    6/10

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads CPU attributes

    behavioral15

MITRE ATT&CK Enterprise v15

Tasks