xmrig_linux | 5f3e06f187c4088882133251e9ee6a03e8f11c73354af3bd6fd7c010b46e78f0

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
29-08-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xmr_linux_amd64
Size

8.7MB
MD5

aff9d4675fdb21bb30e23ab1466b5841
SHA1

bed1388ccca38218fa67ac7670b0e13bf759702e
SHA256

5f3e06f187c4088882133251e9ee6a03e8f11c73354af3bd6fd7c010b46e78f0
SHA512

2ed958de56fa264446d7d85d36c05e693926a6bfeed6d58aeea7aa1d6f595c94b71472c75834c3edc71ffefc4c3fc59a5362e377ee93c651637d77dc20c9ecf0
SSDEEP

98304:6OiwcvRyACNEbruhSGwXUEvNPHbZNcRsR:diNCKbreqv9bZNcRsR

Score

10^/10

xmrig_linux antivm evasion miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral3/files/fstream-4.dat	family_xmrig
behavioral3/files/fstream-4.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig/xmrig-6.21.3/xmrig	1618	xmrig

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org
4	api.ipify.org

Reads hardware information 1 TTPs 14 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/modules	xmr_linux_amd64

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	xmr_linux_amd64
File opened for reading	/proc/cpuinfo	xmrig

Reads CPU attributes 1 TTPs 46 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	xmr_linux_amd64
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/cluster_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/die_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/package_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/base_frequency	xmrig

Enumerates kernel/hardware configuration 1 TTPs 29 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node/node0/cpumap	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_bandwidth	xmrig
File opened for reading	/sys/fs/cgroup/cgroup.controllers	xmrig
File opened for reading	/sys/kernel/mm/hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators	xmrig
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	xmr_linux_amd64
File opened for reading	/sys/fs/cgroup/cpuset.cpus.effective	xmrig
File opened for reading	/sys/devices/system/node/online	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_latency	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_latency	xmrig
File opened for reading	/sys/bus/soc/devices	xmrig
File opened for reading	/sys/fs/cgroup/cpuset.mems.effective	xmrig
File opened for reading	/sys/devices/system/node/node0/access1/initiators	xmrig
File opened for reading	/sys/devices/virtual/dmi/id	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/free_hugepages	xmrig
File opened for reading	/sys/devices/system/cpu	xmrig
File opened for reading	/sys/devices/cpu_core/cpus	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/meminfo	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_bandwidth	xmrig
File opened for reading	/sys/devices/cpu_atom/cpus	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/firmware/dmi/tables/smbios_entry_point	xmrig
File opened for reading	/sys/firmware/dmi/tables/DMI	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/85/stat	xmr_linux_amd64
File opened for reading	/proc/311/stat	xmr_linux_amd64
File opened for reading	/proc/399/stat	xmr_linux_amd64
File opened for reading	/proc/1092/stat	xmr_linux_amd64
File opened for reading	/proc/9/cmdline	xmr_linux_amd64
File opened for reading	/proc/408/comm	xmr_linux_amd64
File opened for reading	/proc/1030/cmdline	xmr_linux_amd64
File opened for reading	/proc/1070/comm	xmr_linux_amd64
File opened for reading	/proc/12/cmdline	xmr_linux_amd64
File opened for reading	/proc/79/comm	xmr_linux_amd64
File opened for reading	/proc/79/stat	xmr_linux_amd64
File opened for reading	/proc/868/stat	xmr_linux_amd64
File opened for reading	/proc/980/cmdline	xmr_linux_amd64
File opened for reading	/proc/1212/status	xmr_linux_amd64
File opened for reading	/proc/1402/cmdline	xmr_linux_amd64
File opened for reading	/proc/cmdline	xmrig
File opened for reading	/proc/373/stat	xmr_linux_amd64
File opened for reading	/proc/1264/stat	xmr_linux_amd64
File opened for reading	/proc/1590/stat	xmr_linux_amd64
File opened for reading	/proc/89/stat	xmr_linux_amd64
File opened for reading	/proc/734/stat	xmr_linux_amd64
File opened for reading	/proc/89/comm	xmr_linux_amd64
File opened for reading	/proc/645/cmdline	xmr_linux_amd64
File opened for reading	/proc/953/comm	xmr_linux_amd64
File opened for reading	/proc/212/cmdline	xmr_linux_amd64
File opened for reading	/proc/97/stat	xmr_linux_amd64
File opened for reading	/proc/1050/stat	xmr_linux_amd64
File opened for reading	/proc/81/comm	xmr_linux_amd64
File opened for reading	/proc/669/comm	xmr_linux_amd64
File opened for reading	/proc/78/cmdline	xmr_linux_amd64
File opened for reading	/proc/498/cmdline	xmr_linux_amd64
File opened for reading	/proc/590/cmdline	xmr_linux_amd64
File opened for reading	/proc/1010/cmdline	xmr_linux_amd64
File opened for reading	/proc/1099/comm	xmr_linux_amd64
File opened for reading	/proc/1590/comm	xmr_linux_amd64
File opened for reading	/proc/1602/comm	xmr_linux_amd64
File opened for reading	/proc/1/limits	sudo
File opened for reading	/proc/82/comm	xmr_linux_amd64
File opened for reading	/proc/91/cmdline	xmr_linux_amd64
File opened for reading	/proc/109/comm	xmr_linux_amd64
File opened for reading	/proc/1176/status	xmr_linux_amd64
File opened for reading	/proc/1473/comm	xmr_linux_amd64
File opened for reading	/proc/1550/stat	xmr_linux_amd64
File opened for reading	/proc/7/cmdline	xmr_linux_amd64
File opened for reading	/proc/19/comm	xmr_linux_amd64
File opened for reading	/proc/405/comm	xmr_linux_amd64
File opened for reading	/proc/959/comm	xmr_linux_amd64
File opened for reading	/proc/1170/cmdline	xmr_linux_amd64
File opened for reading	/proc/80/comm	xmr_linux_amd64
File opened for reading	/proc/1338/comm	xmr_linux_amd64
File opened for reading	/proc/213/stat	xmr_linux_amd64
File opened for reading	/proc/838/stat	xmr_linux_amd64
File opened for reading	/proc/5/comm	xmr_linux_amd64
File opened for reading	/proc/224/comm	xmr_linux_amd64
File opened for reading	/proc/373/status	xmr_linux_amd64
File opened for reading	/proc/629/comm	xmr_linux_amd64
File opened for reading	/proc/1156/comm	xmr_linux_amd64
File opened for reading	/proc/21/comm	xmr_linux_amd64
File opened for reading	/proc/522/comm	xmr_linux_amd64
File opened for reading	/proc/750/cmdline	xmr_linux_amd64
File opened for reading	/proc/1154/comm	xmr_linux_amd64
File opened for reading	/proc/1321/comm	xmr_linux_amd64
File opened for reading	/proc/1399/comm	xmr_linux_amd64
File opened for reading	/proc/1618/cmdline	xmr_linux_amd64

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig/xmrig.tar.gz	xmr_linux_amd64
File opened for modification	/tmp/xmrig/xmrig-6.21.3/config.json	xmr_linux_amd64
File opened for modification	/tmp/xmrig/xmrig-6.21.3/SHA256SUMS	xmr_linux_amd64
File opened for modification	/tmp/xmrig/xmrig-6.21.3/xmrig	xmr_linux_amd64

/tmp/xmr_linux_amd64
/tmp/xmr_linux_amd64
1⤵
- Reads list of loaded kernel modules
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1602
- /usr/bin/sudo
  sudo -n true
  2⤵
  PID:1609
- - /usr/bin/true
    true
    3⤵
    PID:1610
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1617
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1618

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig/xmrig-6.21.3/SHA256SUMS

Filesize
150B

MD5
4f3be397a97fe6981754daeff1c2b77b

SHA1
251612464045242636103e61da4a0bc02c8fb99b

SHA256
1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

SHA512
a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

Download Submit
/tmp/xmrig/xmrig-6.21.3/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig/xmrig-6.21.3/config.json

Filesize
3KB

MD5
2c63dc93a2c74d2a6f6ead20ffa50cdb

SHA1
e7a54d662d30702518f88860c88c6a7e55d200be

SHA256
d094b093b5d5a1b833828ef566318915be92bf95e03dd36b25eb6832e6b5099d

SHA512
dc8f70e77818e7248fa1d251d8d67c0a52af9ca372cb480b58c228855aa0413c0e6a8170622725f2745d90e780e71a5f7b9b3c4a68997a92fdef85153d863d4b

Download Submit
/tmp/xmrig/xmrig-6.21.3/config.json

Filesize
3KB

MD5
1b54b3c2d2c29d72eafeb9b002668cc9

SHA1
d330bc4eb745fdd3bb9013530a6fe18124484bc1

SHA256
298221fcfff63eb16646d64b5de2b08e58c9e9da0ca61dd9e8e084454cd96f80

SHA512
9d9407e8fd70db24b5c85c8b2953e6c22ec6987d7788c5c5cc49595ee13b858f70bbf2bcf3a468f0d3cd741f2a34708478d897d7c165ba8c291432b8803cd6e9

Download Submit
/tmp/xmrig/xmrig-6.21.3/xmrig

Filesize
7.9MB

MD5
7429d24207b100f6c164bf4703b5941e

SHA1
a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

SHA256
72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

SHA512
7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

Download Submit
/tmp/xmrig/xmrig.tar.gz

Filesize
3.3MB

MD5
06b8367fc7b84a666a561a6915a4501d

SHA1
d06991f03408390059df8fc387ac7923e4b5fb7a

SHA256
a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

SHA512
8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads