General
-
Target
5dab75a430ef83e198da5f0323b12f711e5125bd78acf690df8a931f435b42f7.elf
-
Size
1.6MB
-
Sample
240604-btvwrshb75
-
MD5
2ea890cb7b5ee51f4dd3e392d4f8e973
-
SHA1
039601bf8657d485e14a2315b225656e03929bef
-
SHA256
5dab75a430ef83e198da5f0323b12f711e5125bd78acf690df8a931f435b42f7
-
SHA512
ca3af4dfb9b0f8745fa306095dc9c4befa6a21b3465c82d7ec885f8f6b4ef128442ab3dd825bd4a4084f624efab2ea12245f2ee89ff013e0ae11be2720e6d2c6
-
SSDEEP
49152:zEXwA+Gcx+AzAwrZWngLcrvphUY4bTY5zJw9lNmZL15b:yXcbMyZWng4bpakWQ5b
Malware Config
Targets
-
-
Target
5dab75a430ef83e198da5f0323b12f711e5125bd78acf690df8a931f435b42f7.elf
-
Size
1.6MB
-
MD5
2ea890cb7b5ee51f4dd3e392d4f8e973
-
SHA1
039601bf8657d485e14a2315b225656e03929bef
-
SHA256
5dab75a430ef83e198da5f0323b12f711e5125bd78acf690df8a931f435b42f7
-
SHA512
ca3af4dfb9b0f8745fa306095dc9c4befa6a21b3465c82d7ec885f8f6b4ef128442ab3dd825bd4a4084f624efab2ea12245f2ee89ff013e0ae11be2720e6d2c6
-
SSDEEP
49152:zEXwA+Gcx+AzAwrZWngLcrvphUY4bTY5zJw9lNmZL15b:yXcbMyZWng4bpakWQ5b
Score10/10-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (940099) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-