Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
30-08-2024 07:58
General
-
Target
SecuriteInfo.com.Linux.Miner-ZS.18234.26199
-
Size
14.0MB
-
MD5
648effa354b3cbaad87b45f48d59c616
-
SHA1
0194637f1e83c2efc8bcda8d20c446805698c7bc
-
SHA256
6e25ad03103a1a972b78c642bac09060fa79c460011dc5748cbb433cc459938b
-
SHA512
7ed0b6abeda6b3682bb94fbce8c5eeddf6206db23a87c11d606ea2f84a7606420ed47290317b5d9cb4d99f5c07943b8a7a548671d4c73106d6fbd48cd37bc146
-
SSDEEP
98304:zpU9MTfASNlnewCIoxAlfVG9bnY+Zx+A:zG9GfASNlnewChxAxVWbY
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 3 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 55 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/SecuriteInfo.com.Linux.Miner-ZS.18234.26199/tmp/SecuriteInfo.com.Linux.Miner-ZS.18234.261991⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/getconf/usr/bin/getconf CLK_TCK2⤵
-
-
/tmp/SecuriteInfo.com.Linux.Miner-ZS.18234.26199/tmp/SecuriteInfo.com.Linux.Miner-ZS.18234.261992⤵
- Reads list of loaded kernel modules
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/usr/bin/getconf/usr/bin/getconf CLK_TCK3⤵
-
-
/usr/bin/shsh -c "pkill -f kdevtmpfsi"3⤵
-
/usr/bin/pkillpkill -f kdevtmpfsi4⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/usr/bin/shsh -c "chmod +x /tmp/kdevtmpfsi"3⤵
-
/usr/bin/chmodchmod +x /tmp/kdevtmpfsi4⤵
-
-
-
/usr/bin/shsh -c "/tmp/kdevtmpfsi &"3⤵
-
-
-
/tmp/kdevtmpfsi/tmp/kdevtmpfsi1⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/sbin/modprobe/sbin/modprobe msr2⤵
- Enumerates kernel/hardware configuration
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD52aedcba61ca55ceb62d785c6b7f10a83
SHA1b3a1739aaf1195342c2b34bbaf4e3aaa544ee875
SHA2569f2ca3ad31656671b9e0bf12509c9e71dac5b8e8834145767f684bf193945d33
SHA512424a95ea8dd4ca53556fd15272e8010aaa148004e8b37dbab7227ad2c4266ce88571945f4ce8eb944720cca2a9517b3790790090a78d91b492e6b22da1114bac
-
Filesize
36B
MD509b9854235403028d2c9d87a6156420d
SHA18de6035cd759abb6bc4e1d8a0834fbbe96c1700a
SHA256b03c4d8b85f7ab7c8356cbadf169e5c5fe11047fca0e5ad4f57050d18fcb4ddb
SHA51282f20fcfa46d6355b636be87fbc0d21996a6f871dc5ce070ed92529ceadfa3802e06930ec0f7e9893c3927a1a2b83c087ff524825cd5cfe14f658c6d47fe444d
-
Filesize
3.7MB
MD58c6681daba966addd295ad89bf5146af
SHA164c558567e9566a6ecb1e97000a63d079348bf4c
SHA256dd603db3e2c0800d5eaa262b6b8553c68deaa486b545d4965df5dc43217cc839
SHA512a94ea9f61481d8d42e38c86067c258d830f6c899e032cd69f1769006ae24bf3be7f1b0071d51ae4d304740129919de113515eac3b7460123e1e01fe949bb6e4e