Resubmissions

26-06-2024 08:35

240626-khaacsyckr 7

26-06-2024 08:35

240626-kgz5dswakb 7

26-06-2024 08:34

240626-kgw3qsycjk 7

26-06-2024 08:34

240626-kgtbvawajc 7

26-06-2024 08:34

240626-kglxrsybqp 7

26-06-2024 08:34

240626-kgfqravhqf 7

26-06-2024 08:33

240626-kgavhavhpg 7

26-06-2024 08:33

240626-kf3twsybnl 7

26-06-2024 08:32

240626-kfpl9svhme 7

26-06-2024 08:32

240626-kfcygavhla 7

Analysis

  • max time kernel
    1794s
  • max time network
    1796s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    26-06-2024 08:30

General

  • Target

    run.sh

  • Size

    404B

  • MD5

    c3ab72c96f79d89cf768144d9d98070f

  • SHA1

    ff6426eac260f84825fdc938afdb2302734ed754

  • SHA256

    cc6ed95cfdf33fc88e8a1de7dc8b1ecadd1af196e5e9d26f0b277deada2b01c4

  • SHA512

    98a9b5dd77ddba6975426e2c13d97850a8eb4f2e3b95e53cb35fe64ed69caf75ca18b31592fc8e4c84efa16653764ca902f7c301fe58613272c82ed969e45802

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 3 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 17 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/run.sh
    /tmp/run.sh
    1⤵
      PID:1391
      • /usr/bin/wget
        wget -O cpuminer.tar.gz https://github.com/rplant8/cpuminer-opt-rplant/releases/download/5.0.40/cpuminer-opt-linux-5.0.40.tar.gz
        2⤵
        • Writes file to tmp directory
        PID:1392
      • /usr/bin/tar
        tar -xf cpuminer.tar.gz
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1438
        • /usr/local/sbin/gzip
          gzip -d
          3⤵
            PID:1439
          • /usr/local/bin/gzip
            gzip -d
            3⤵
              PID:1439
            • /usr/sbin/gzip
              gzip -d
              3⤵
                PID:1439
              • /usr/bin/gzip
                gzip -d
                3⤵
                  PID:1439
              • /usr/bin/chmod
                2⤵
                  PID:1440
                • /usr/bin/nproc
                  2⤵
                    PID:1441
                  • /tmp/cpuminer-sse42-aes
                    2⤵
                    • Executes dropped EXE
                    • Checks hardware identifiers (DMI)
                    • Reads MAC address of network interface
                    • Reads hardware information
                    • Checks CPU configuration
                    • Reads CPU attributes
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1442
                    • /bin/sh
                      sh -c -- "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
                      3⤵
                        PID:1443
                        • /sbin/modprobe
                          /sbin/modprobe msr "allow_writes=on"
                          4⤵
                          • Reads runtime system information
                          PID:1444

                  Network

                  MITRE ATT&CK Matrix ATT&CK v13

                  Defense Evasion

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Discovery

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  System Network Configuration Discovery

                  1
                  T1016

                  System Network Connections Discovery

                  1
                  T1049

                  System Information Discovery

                  3
                  T1082

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /root/.wget-hsts
                    Filesize

                    165B

                    MD5

                    09faa5dce23effcf901838e8f5d11c31

                    SHA1

                    7f43d6fa9728dbf8d3aee833094680935d1e5000

                    SHA256

                    ab6278bfacba9589eaac6728f1f6badd95a7325b4d1ced45ad6c84cadd362c36

                    SHA512

                    71728018959dea9922c791e4b817771745c82871d77ef82a042f6139b134bab5c9426c97e41e302fb666adf854d49eb8b4ee83bdc2c9e395a223f35bc8fe723c

                  • /tmp/cpuminer-avx
                    Filesize

                    3.1MB

                    MD5

                    22b710780b2ef92b5e4badfcb3e161ab

                    SHA1

                    634d032a2024abde8aaecdb3c02d64dccdabd08d

                    SHA256

                    e3a39579707a0844aa1b90210786fc6893541f65cb8144d573386b54395ce7de

                    SHA512

                    971072d579d09179bd4823ad80d68db43648d6b9d36dd3b1064a895c0921ede9abbf47874db587108d1794941fec036d72c527158b1e4e7b7847611a94e11801

                  • /tmp/cpuminer-avx2
                    Filesize

                    3.4MB

                    MD5

                    49fb54a04c596c9be79c122955b946eb

                    SHA1

                    8f9e75ae090676f10079153401ab14fac5359ade

                    SHA256

                    afed09f7e34012dd802c48ebef29b0ac3d32a940ee692ed3c6be10665d5f8124

                    SHA512

                    0b6ee36a56d27fa85630fc51ee36607de5f90b18c04be57d0a42cdab3a87c12994ebbeab5574c6d95faff6a229314e887b7653cb3f8f38e959576810d04afee9

                  • /tmp/cpuminer-avx512
                    Filesize

                    3.5MB

                    MD5

                    f68d951913f722b5cd9e4dd230bee7e3

                    SHA1

                    ac23aa5b5fb908834fb6dd47729881fd2f712dfc

                    SHA256

                    d0079a9a7a397a00101f0a061f86bbb7e94179a4c57ac3b2253374d5e515ed08

                    SHA512

                    b0010c8fe75027f2522097d03a6cebe55586aa0e87eae991fba44bd26e2de32a5a9093e5e367b4d34d9e928d693b4aff9ff5abc232a941b4015fdcfdd16926b2

                  • /tmp/cpuminer-avx512-sha-vaes
                    Filesize

                    3.6MB

                    MD5

                    bca6f4a0b53755cc6a57fa796af8f277

                    SHA1

                    2bf4f123672c67608374e34cd809c6a34d963b4d

                    SHA256

                    911628557c610e74d32d07dfb67152a06b43ca7a1ee9258fd1b0ca979595024e

                    SHA512

                    65d28dd2a4c7216313eaf032773f20a1946c1068b670dcac5ba288c9ce75ec59284e50d5a7604f249b0be694827db01e27b590667033fe245eee8726d4627b0a

                  • /tmp/cpuminer-ryzen
                    Filesize

                    3.4MB

                    MD5

                    97976f553e9a513f167c51903aa88e9e

                    SHA1

                    b64fcd3d617d460f668517458da4f2d56586e10a

                    SHA256

                    b7229f8043e1af5acbd66257038ace2869aff711d81b2e726a64ae06cca70784

                    SHA512

                    25b2c11e8a4e8342247a776694f8583393cc9578b5e487c009e3a571d36a92dea55cb8104c4c4544fd4e2e91b049b7a7d30fd94d22e88e7f24736297753899ac

                  • /tmp/cpuminer-sse2
                    Filesize

                    3.1MB

                    MD5

                    406a6480aee5192d0df7ea213bd97264

                    SHA1

                    205997278383b6a685beb150f08955ac9c39b332

                    SHA256

                    da30c7a8acaa9ac8e625728c4a918831ce436c38cdfa0cb4fccedad73fc0ecaa

                    SHA512

                    3b75f9c5e5e4852c9aefec19dabd77f859db7bc9bf50c29ce207ac57a8433823d158f574ea288c03cb008745c5e7c4c4c5957734f2b10ea3f27bf59897af3f61

                  • /tmp/cpuminer-sse2amd
                    Filesize

                    3.1MB

                    MD5

                    a460c47840cd2c014691c03b17382e13

                    SHA1

                    28aba3a0f0d0148eb9fa8ea98214591ca19de245

                    SHA256

                    26d68a19af3feedaa6726a85e2c31158ef088f741ccc0e8edd1269ce566128b8

                    SHA512

                    f6c1c680aab10004800f3157ba8852d31ce0ddb72c5db858f5dacdfd503369cd36f82d4f10ef425c3512e5bfac30a49a7edef540e6f54449cec795d52d7f09dc

                  • /tmp/cpuminer-sse42
                    Filesize

                    3.2MB

                    MD5

                    03a3c14f8c27d508b292b53efc702982

                    SHA1

                    eef2df65c0f456ffd25853a17567b58b03299559

                    SHA256

                    4f2f4fab5f7f63bc34b099090bdcb8c69541e4fd3f34f1d80eaa45c19ccfd3d8

                    SHA512

                    fa8641377ddd49546d4aa65d02e61b982f25ed1f73fcae0e00bf7037d9a87f0cd945e92274f76db8fe73353e7c16c619c51227b0d2224e9f794a30114acce621

                  • /tmp/cpuminer-sse42-aes
                    Filesize

                    2.7MB

                    MD5

                    c0e90e60d647f8e92ea0c40b5a758c1d

                    SHA1

                    c6eb4cc45f78db4cc1fc4844a18eaac4877d7c14

                    SHA256

                    adc0d3015a7113893a40c3c685812ba471af615980e4f2f306da9da5bf3267ad

                    SHA512

                    4a1dae310067a852a16655e454c893a24fd83e7436fb3d21b7e00dd6b956cc76298c1c78607c0477548c4bf8f6fa457dc8b855e17d78b01280e58d7eeb845cc4

                  • /tmp/cpuminer.tar.gz
                    Filesize

                    28.9MB

                    MD5

                    e9312b85e3bd6db840bc358668a7f37e

                    SHA1

                    e4f483655509a895d93ff23678053fa1825e2d7d

                    SHA256

                    1c87158ee3ae452a4d78cf4749953a0bdb9532113379f0484b65daf215f4cb7a

                    SHA512

                    666aa7237db6c450c79db169ebb10ac29396d31ecc58070b9c2150bf2f0d79d8115b15dc9d7edb91ba72d8305d2bd4d8e4144fd72b93b603d678f7e5be94e9cd

                  • /tmp/miner-avian-minotaurx.sh
                    Filesize

                    376B

                    MD5

                    84caf2054bbae6b60875e06310299378

                    SHA1

                    1b0ef23e1c61e67322a36b935150e4809235d1db

                    SHA256

                    d9cfb46648a5bf259dec1a91996ac1530e09d01341d05d343de18892f5691d7b

                    SHA512

                    08625fb771a1590226a061b3d394191a8a089fd7c2ccd65ecadbbdb11316bb041470d0fd0f01f370a40aa0df5e2de3f412d026ee179af4bf83dfd3e4af2042f1

                  • /tmp/miner-dpowcoin.sh
                    Filesize

                    381B

                    MD5

                    48f2ad9e9d73a2a61de256163b0a90ef

                    SHA1

                    1807209e3d02f6bcf50919549a73f35ad2b65e97

                    SHA256

                    06687d58e56fb8ea72285bb99cac60ad9186239fa3d95c1e943a65f691d2319d

                    SHA512

                    4ebaee9fa6a88f6982acefef670edc5b963197ad7448b1b23aefbc89fdd0fa96568a6efee248ae3fe96962075417ea6f765ab5116b2613eb22ad6fa9c66b7468

                  • /tmp/miner-goldcash.sh
                    Filesize

                    385B

                    MD5

                    a6ce27365dfe4ec79dc59240de8860be

                    SHA1

                    822c20040f7a27b9604b205d7593741490fe96cb

                    SHA256

                    22b8949e17458b0472bd1b7ab9e683f28b7ccc3f884e30cc1367e6b2b1192c26

                    SHA512

                    68dc463b782f4799388ebe9c4464a74990829aea0b17d2e40590d4f7552c4a7baefb8a89071f0fcdc35a23d0003e47653a15beca870854f4a4e5c983d74e7c54

                  • /tmp/miner-raptoreum.sh
                    Filesize

                    215B

                    MD5

                    accff0162caa25fdce0857df48a8c463

                    SHA1

                    21670cbedd0ac120fc8abaaad51de91336fa8c91

                    SHA256

                    c8b33d6dd9832d5a4302c5e3cfe1db7c67a96ee02f9faea7ff783b6a4bee3bea

                    SHA512

                    278b60ca4f48a7873dc2c72b332fcaa8df2702e4c649c14f3b2d37fd1f554029be6776d7739e0313347407933b26cd2fe9b6479adf59059bfeb99a5b638de130

                  • /tmp/miner-sugar.sh
                    Filesize

                    380B

                    MD5

                    773663b4e2c8232c707082bddf6db8c2

                    SHA1

                    298469b7cd0f3ac7aa2d5d8320ce17bd3b8a3185

                    SHA256

                    1bae4c98c1923ace1c7de0454a410c61dc8d075870fdfad267b1371f55f235a3

                    SHA512

                    606c5394d9e04023f3c150f6c0e04762834b03e2c5c0ddd68f83e4f87e582890d37c3aced5ea65061c554d6ae210127f9b9e264fad4ee56827abec3615681c54

                  • /tmp/miner-tidecoin.sh
                    Filesize

                    379B

                    MD5

                    f256a2a753463a47ca4f35ad489f17b6

                    SHA1

                    6cf7d81bde46c796f9c945ce1bd8991343612fe4

                    SHA256

                    ab34e30993fea54efc5bdbaacc72ed9e33934523e5802c5b9ecd4ebf19517569

                    SHA512

                    3fe6571ed080b6d7e398ee0c6e11b421eca76ca5695dcf1e41656848344f8648138b731b23d6e820680213817c21df5e1f7cb2e6162a98db7d800e936fd45d9e

                  • /tmp/miner-yenten.sh
                    Filesize

                    385B

                    MD5

                    e0f70b83ce5814641c2d18ef9d92629d

                    SHA1

                    ee722fe50ef924ac2da57e4854c6d63152b548ae

                    SHA256

                    7259bd2d5392578457b4b83081af03bb25cb9afe62a6f5a2ca795052de5b4ab4

                    SHA512

                    83f6efa1f9200d83476cb572c56aa54c36e907f24a41c2c530cfdb51c87420b98a94712cbb2797e03a584d4f7eb88871f6827249edbc506eecc3e6fb083c5f33

                  • memory/1442-1-0x0000000000400000-0x0000000000afcbd8-memory.dmp