xmrig_linux | ae4d52616a89bd1f4438d696b4917d57b22df0197c815e769e2859faffe22492

General

Target
9bdbe7cc8c0c8ef3d375b1f671796336_JaffaCakes118
Size 30KB
Sample240815-2blhgsybnb
SHA256 ae4d52616a89bd1f4438d696b4917d57b22df0197c815e769e2859faffe22492
MD5 9bdbe7cc8c0c8ef3d375b1f671796336
SHA1 b0cd1a13849276d0c173ef9390dd22673a1908ee
SHA512 2fe708ebc92daf8c9c4ef9d84fa71619c42728c40b097ee2f4e049022c25253298505f7dc6f7bf724ea4e3ec4f46e03e826ec9e30bc5e57a946c233252d50317
SSDEEP 768:n+78zQ5VFNcDAFLcIwgnoYq0xFBVZAw2v:nMVF+D6cIwgoszS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  9bdbe7cc8c0c8ef3d375b1f671796336_JaffaCakes118
- Size 30KB
- SHA256 ae4d52616a89bd1f4438d696b4917d57b22df0197c815e769e2859faffe22492
- MD5 9bdbe7cc8c0c8ef3d375b1f671796336
- SHA1 b0cd1a13849276d0c173ef9390dd22673a1908ee
- SHA512 2fe708ebc92daf8c9c4ef9d84fa71619c42728c40b097ee2f4e049022c25253298505f7dc6f7bf724ea4e3ec4f46e03e826ec9e30bc5e57a946c233252d50317
- SSDEEP 768:n+78zQ5VFNcDAFLcIwgnoYq0xFBVZAw2v:nMVF+D6cIwgoszS
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig_linux evasion miner rootkit
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Deletes system logs
  Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
  evasion
- Flushes firewall rules
  Flushes/ disables firewall rules inside the Linux kernel.
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Disables AppArmor
  Disables AppArmor security module.
- Disables SELinux
  Disables SELinux security module.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

xmrig

Deletes system logs

Flushes firewall rules

Loads a kernel module

Attempts to change immutable files

Disables AppArmor

Disables SELinux

Enumerates running processes

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4