Overview

overview

10

Static

static

1

requiremetns.sh

debian-12-armhf

10

requiremetns.sh

debian-12-mipsel

10

requiremetns.sh

debian-9-armhf

6

requiremetns.sh

debian-9-mips

10

requiremetns.sh

debian-9-mipsel

10

requiremetns.sh

ubuntu-18.04-amd64

6

requiremetns.sh

ubuntu-20.04-amd64

10

requiremetns.sh

ubuntu-22.04-amd64

10

requiremetns.sh

ubuntu-24.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    requiremetns.sh

  • Size

    8KB

  • Sample

    240701-j9pcxsvbmj

  • MD5

    97423634cc1762b2f010cb860e7fb47d

  • SHA1

    2f50775e8fe9ab98a80f06d835c5874091bf0b3e

  • SHA256

    d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd

  • SHA512

    bd5279178f713edaca1754937a859fa41dbec1fdd15c8ad3cb11894142e389d97bf3ca7f0402c018a616053b1121650ed609498a4b34c4def829e02924f6de1f

  • SSDEEP

    192:fFa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:fEHexC+HSAHE3YUN+TC8SbmQUfd

Score
10/10
xmrigxmrig_linuxantivminfostealerlinuxminer

Malware Config

Targets

    • Target

      requiremetns.sh

    • Size

      8KB

    • MD5

      97423634cc1762b2f010cb860e7fb47d

    • SHA1

      2f50775e8fe9ab98a80f06d835c5874091bf0b3e

    • SHA256

      d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd

    • SHA512

      bd5279178f713edaca1754937a859fa41dbec1fdd15c8ad3cb11894142e389d97bf3ca7f0402c018a616053b1121650ed609498a4b34c4def829e02924f6de1f

    • SSDEEP

      192:fFa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:fEHexC+HSAHE3YUN+TC8SbmQUfd

    Score
    10/10
    xmrig_linuxantivmminerxmriginfostealer

    • XMRig Miner payload

      miner

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Executes dropped EXE

    • Reads EFI boot settings

      Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

      infostealer

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Legitimate hosting services abused for malware hosting/C2

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks