Overview

overview

10

Static

static

7

SecuriteIn...50.elf

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20-05-2024 22:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4274.18395.31150.elf

  • Size

    1.7MB

  • MD5

    44de739950eb4a8a3552b4e1987e8ec2

  • SHA1

    0ae049aab363fb8d2e164150dffbafd332725e00

  • SHA256

    9b81bad2111312e669697b69b9f121a1f9519da61cd5d37689e38381c1ffad28

  • SHA512

    92ec17d3929b16353b40b29eefb5ad1de26621a20dc1c065e7cd9f294a9763844ff8673730d00f1a255ad4d42e06a1fb3171822db59dd20c639d3ff691256a7c

  • SSDEEP

    49152:njEflQ/573nydbeONLwFCRTrgcSzNpZWPU6B:jEflQRTydb/ZwGrwzNpCB

Score
10/10
xmrigantivmminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 2 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 63 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4274.18395.31150.elf
    /tmp/SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4274.18395.31150.elf
    1⤵
    • Modifies hosts file
    • Checks hardware identifiers (DMI)
    • Reads hardware information
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1494
    • /bin/sh
      sh -c "rm -f /etc/hosts.old"
      2⤵
        PID:1498
        • /bin/rm
          rm -f /etc/hosts.old
          3⤵
            PID:1499
        • /bin/sh
          sh -c "mount --bind /proc/1 /proc/1502"
          2⤵
            PID:1503
            • /bin/mount
              mount --bind /proc/1 /proc/1502
              3⤵
              • Reads runtime system information
              PID:1504

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Virtualization/Sandbox Evasion

        2
        T1497

        Credential Access

        Discovery

        Virtualization/Sandbox Evasion

        2
        T1497

        System Information Discovery

        3
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /etc/hosts
          Filesize

          219B

          MD5

          f483993c70d12ecfd5a5fe3ed5b10244

          SHA1

          386b3c58555b1337c5a2496efdb7436295256796

          SHA256

          908b62e9f94cc492b2ad465bfae5ba6bb5cfffd9ad7af21cdb79821ee118f409

          SHA512

          c60a7528f3d5b5b97d79c7973153cb7a915de04fd717e9ca7c8bdf4093a747146d405c15d47f822dc1b72bcd87b19ab276e9069c3f41bc5bb4dbfd88fd469aaa

          Download Submit
        • /run/mountinfo
          Filesize

          16B

          MD5

          653d149c30cfe9f06aaa1be6fd083928

          SHA1

          64d67d009efa44f08307d3161db27e94248692cc

          SHA256

          a3f2fde8269f814a0342ce24b00b74117d4f1a41f4b47c805b2eae7a9e604514

          SHA512

          2fdfc43da5d5c8f2059416006c517f6dea22303bf42bf23c8252ea57755e22919787472ca46ff0547c3af358c7fc1d5cc403c15e7f94ebd3678d74810d1db0f5

          Download Submit
        • /run/mountinfo.log
          Filesize

          1KB

          MD5

          7bde0ccdccecfdd774b99b9c32b6b9c0

          SHA1

          305958ce5abf33e97631a977a6ec9e5612e14b20

          SHA256

          7be67248ba0500d5d6017b01e34cbeb87636d71b2d7a94e521e262d790be61ff

          SHA512

          1c3678d2a2d55aae5457added80933067bf8819038274597de28b5cef36c4feddf224a1ece8dbf7f10a6bb7f43fd2dd9d94840cfcde9de1c293b1051079a0e74

          Download Submit
        • memory/1494-1-0x0000000000400000-0x0000000000acfb60-memory.dmp
          Download