General
-
Target
587dbc8371a8a8e2424eceec829b0763.bin
-
Size
1.8MB
-
Sample
240419-bmsg3acd22
-
MD5
97b90cc168666b36c1acb695c6e1274b
-
SHA1
6c4e9df9bdf6b29cb052c6d514c026b5fdf601fd
-
SHA256
4614241d7967fbac27677f4c559e0a9a0c403cdf62327efd218e256a94d6890a
-
SHA512
852d63c340d058fa16e9acb13719faedcd84034c07694aa4b1dfeb38315b564f2a9ec1a255efd9cef3ed1c85660f3e7a8e5f890f9eedc05ed896dddaa25043c1
-
SSDEEP
24576:P0j691uga7p43mSh5Lx0hcgyq4XuFDZ8L6wXJy0R5B3KbtlQgFfd9Rb63etbehuU:P0jyyM52t49L55b5obtlQMm4besPr5K
Malware Config
Targets
-
-
Target
015a5025ba2d3a419165d506f399cef408fb611427debe725a76b44a482c7f24.elf
-
Size
1.8MB
-
MD5
587dbc8371a8a8e2424eceec829b0763
-
SHA1
4d1afaa6bc5766650c1bdd1ed3169e948032c1ff
-
SHA256
015a5025ba2d3a419165d506f399cef408fb611427debe725a76b44a482c7f24
-
SHA512
78beb44ae9825a063868ece8efa3b5765c77d4bdac0120591fe80aebe46339781c795e488c8b8e3b7edfcf6a10298e7749be234cd78f37eec0eb620504d160b9
-
SSDEEP
49152:AdoCxUiQ7gCnKqiv2my8mrvgYR7fzRs5mMu:qoMkvXO2mGrrntMu
-
Contacts a large (2025559) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
Changes its process name
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks CPU configuration
Checks CPU information which indicate if the system is a virtual machine.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-