Overview

overview

10

Static

static

1

xmr_linux_amd64.elf

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240522.1-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    18-09-2024 06:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr_linux_amd64.elf

  • Size

    8.7MB

  • MD5

    aff9d4675fdb21bb30e23ab1466b5841

  • SHA1

    bed1388ccca38218fa67ac7670b0e13bf759702e

  • SHA256

    5f3e06f187c4088882133251e9ee6a03e8f11c73354af3bd6fd7c010b46e78f0

  • SHA512

    2ed958de56fa264446d7d85d36c05e693926a6bfeed6d58aeea7aa1d6f595c94b71472c75834c3edc71ffefc4c3fc59a5362e377ee93c651637d77dc20c9ecf0

  • SSDEEP

    98304:6OiwcvRyACNEbruhSGwXUEvNPHbZNcRsR:diNCKbreqv9bZNcRsR

Score
10/10
xmrig_linuxantivmcredential_accessdefense_evasiondiscoveryevasionminerprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • OS Credential Dumping 1 TTPs 2 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 29 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr_linux_amd64.elf
    /tmp/xmr_linux_amd64.elf
    1⤵
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1553
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:1573
      • /usr/bin/true
        true
        3⤵
          PID:1574
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1575
        • /tmp/xmrig/xmrig-6.21.3/xmrig
          /tmp/xmrig/xmrig-6.21.3/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /tmp/xmrig/xmrig-6.21.3/SHA256SUMS
      Filesize

      150B

      MD5

      4f3be397a97fe6981754daeff1c2b77b

      SHA1

      251612464045242636103e61da4a0bc02c8fb99b

      SHA256

      1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

      SHA512

      a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/config.json
      Filesize

      2KB

      MD5

      66f38c96a4901e7b345787c447842b3e

      SHA1

      2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

      SHA256

      2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

      SHA512

      71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/config.json
      Filesize

      3KB

      MD5

      4e45ae76cdf782b411dbdbcace9da99a

      SHA1

      810679cda153dec552d3c392d1890f37d899d4df

      SHA256

      005c89812f87e457f8197bd391cea66bd5562683c1debef0de75fcdc090216f4

      SHA512

      2f785889f0c547643787dbd8c8d1313d4f74639d5018284cbde7054c7b761d59d7e5b0675227ddb5911c96f514e348641e2581deb387478ed656f0fe68ad748e

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/config.json
      Filesize

      3KB

      MD5

      346255ac27f439569392c47593d676d9

      SHA1

      2081779fe3632656f37f84821a9ecd95ef24188b

      SHA256

      b35e14aecfb67b3b4d62d935d06baa76da5839b4b167dc7f0bf2a5b7d11312cc

      SHA512

      297c87caa25fee4d1a28febb099e8ba23d83c74fde4143e5d9b8a58c88a2c63b4dadbed5b47eb5a3bb0e2b144e1e5107fcf7f29af1c225e0fa29fedfdd8df875

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/xmrig
      Filesize

      7.9MB

      MD5

      7429d24207b100f6c164bf4703b5941e

      SHA1

      a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

      SHA256

      72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

      SHA512

      7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

      Download Submit

    • /tmp/xmrig/xmrig.tar.gz
      Filesize

      3.3MB

      MD5

      06b8367fc7b84a666a561a6915a4501d

      SHA1

      d06991f03408390059df8fc387ac7923e4b5fb7a

      SHA256

      a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

      SHA512

      8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

      Download Submit