xmrig_linux | f73852da62dd7d56a74a82144a5cfd694201fca36a7b86888f1a8f069f6b3492

General

Target

257c6ea365b6ca33dd34c90584ed88bb_JaffaCakes118
Size

30KB
Sample

240704-lpxjxavcjq
MD5

257c6ea365b6ca33dd34c90584ed88bb
SHA1

655704ef149ea4a9667089442209854460c4c78f
SHA256

f73852da62dd7d56a74a82144a5cfd694201fca36a7b86888f1a8f069f6b3492
SHA512

c2a38716ee954f0dd6bc143168950a5f2c8ea180bad6a968f86c837bd7c25487de8c427c5e086f433f09ca805d9bb8deb9e1f000f610748999e2c62d3a095afd
SSDEEP

384:p7pQBDf6jlpTWg3vMGQiirhHwMyGj4CC9vEKMvU/4Qdre21jT58vKpG2Y0orcfKe:p78zQ5VFNcDAFLcIwgnoYq0xFBVZHtln

Score

10^/10

Malware Config

Targets

- Target
  
  257c6ea365b6ca33dd34c90584ed88bb_JaffaCakes118
- Size
  
  30KB
- MD5
  
  257c6ea365b6ca33dd34c90584ed88bb
- SHA1
  
  655704ef149ea4a9667089442209854460c4c78f
- SHA256
  
  f73852da62dd7d56a74a82144a5cfd694201fca36a7b86888f1a8f069f6b3492
- SHA512
  
  c2a38716ee954f0dd6bc143168950a5f2c8ea180bad6a968f86c837bd7c25487de8c427c5e086f433f09ca805d9bb8deb9e1f000f610748999e2c62d3a095afd
- SSDEEP
  
  384:p7pQBDf6jlpTWg3vMGQiirhHwMyGj4CC9vEKMvU/4Qdre21jT58vKpG2Y0orcfKe:p78zQ5VFNcDAFLcIwgnoYq0xFBVZHtln
Score

10^/10

xmrig_linux evasion miner rootkit
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  evasion
- Flushes firewall rules
  Flushes/ disables firewall rules inside the Linux kernel.
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Disables AppArmor
  Disables AppArmor security module.
- Disables SELinux
  Disables SELinux security module.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

xmrig

Deletes system logs

Flushes firewall rules

Loads a kernel module

Attempts to change immutable files

Disables AppArmor

Disables SELinux

Enumerates running processes

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4