Overview

overview

10

Static

static

1

xmr_linux_amd64

ubuntu-18.04-amd64

10

xmr_linux_amd64

ubuntu-20.04-amd64

10

xmr_linux_amd64

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    134s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    29-08-2024 04:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr_linux_amd64

  • Size

    8.7MB

  • MD5

    aff9d4675fdb21bb30e23ab1466b5841

  • SHA1

    bed1388ccca38218fa67ac7670b0e13bf759702e

  • SHA256

    5f3e06f187c4088882133251e9ee6a03e8f11c73354af3bd6fd7c010b46e78f0

  • SHA512

    2ed958de56fa264446d7d85d36c05e693926a6bfeed6d58aeea7aa1d6f595c94b71472c75834c3edc71ffefc4c3fc59a5362e377ee93c651637d77dc20c9ecf0

  • SSDEEP

    98304:6OiwcvRyACNEbruhSGwXUEvNPHbZNcRsR:diNCKbreqv9bZNcRsR

Score
10/10
xmrigantivmevasionminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 1 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 27 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr_linux_amd64
    /tmp/xmr_linux_amd64
    1⤵
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1496
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • Reads runtime system information
      PID:1503
    • /tmp/xmrig/xmrig-6.21.3/xmrig
      /tmp/xmrig/xmrig-6.21.3/xmrig
      2⤵
      • Executes dropped EXE
      • Checks hardware identifiers (DMI)
      • Reads hardware information
      • Checks CPU configuration
      • Reads CPU attributes
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1507

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /tmp/xmrig/xmrig-6.21.3/SHA256SUMS
    Filesize

    150B

    MD5

    4f3be397a97fe6981754daeff1c2b77b

    SHA1

    251612464045242636103e61da4a0bc02c8fb99b

    SHA256

    1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

    SHA512

    a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

    Download Submit

  • /tmp/xmrig/xmrig-6.21.3/config.json
    Filesize

    2KB

    MD5

    66f38c96a4901e7b345787c447842b3e

    SHA1

    2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

    SHA256

    2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

    SHA512

    71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

    Download Submit

  • /tmp/xmrig/xmrig-6.21.3/config.json
    Filesize

    3KB

    MD5

    2c63dc93a2c74d2a6f6ead20ffa50cdb

    SHA1

    e7a54d662d30702518f88860c88c6a7e55d200be

    SHA256

    d094b093b5d5a1b833828ef566318915be92bf95e03dd36b25eb6832e6b5099d

    SHA512

    dc8f70e77818e7248fa1d251d8d67c0a52af9ca372cb480b58c228855aa0413c0e6a8170622725f2745d90e780e71a5f7b9b3c4a68997a92fdef85153d863d4b

    Download Submit

  • /tmp/xmrig/xmrig-6.21.3/config.json
    Filesize

    3KB

    MD5

    820695b165911c5863217cf2444312d2

    SHA1

    953e90c17f563bbd4404786f7070fce52cb033f1

    SHA256

    8734485b9d78eff09c5203091451f9b7f8ed2f82c6320043230640bb028b43f1

    SHA512

    c63243489344ee5f0c9f7db68b4809a455f7c266434a96039901a8f71225d30aefad869f56983e00d71cc0154c821ee40202a028f8cd88b1ef283dcf0b1ab877

    Download Submit

  • /tmp/xmrig/xmrig-6.21.3/xmrig
    Filesize

    7.9MB

    MD5

    7429d24207b100f6c164bf4703b5941e

    SHA1

    a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

    SHA256

    72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

    SHA512

    7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

    Download Submit

  • /tmp/xmrig/xmrig.tar.gz
    Filesize

    3.3MB

    MD5

    06b8367fc7b84a666a561a6915a4501d

    SHA1

    d06991f03408390059df8fc387ac7923e4b5fb7a

    SHA256

    a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

    SHA512

    8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

    Download Submit