Overview

overview

10

Static

static

1

xmr_linux_...2).elf

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    21-09-2024 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr_linux_amd64 (2).elf

  • Size

    8.7MB

  • MD5

    2352fd3e33ed079446cad48ee044df18

  • SHA1

    2c1802e6f3eb067984245b0c23d2f093a93a42cc

  • SHA256

    dbf22aada7e9efa11116411e1d6f18f6ecbb215d53e21d6f769e1869f4e8160b

  • SHA512

    8a7c06d8db5083300844f8100a8bfeee4e0566b89a4c6791b1bc2b4a12cb55fe12f1d07dfbd972b58944cb2c3f5a0ce24cda554b3a82f07fe031795de290d637

  • SSDEEP

    49152:I629tnIbPfVYG2VSLDhZlCcbZeXAGM0R62LP6XmhgeyWZ3Twkj5EgUuEZ/3z7JJP:I6CtuPdYWhZYGGM0RN6Xm2EPVEgq3/L

Score
10/10
xmrig_linuxantivmcredential_accessdefense_evasiondiscoveryevasionminerprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • OS Credential Dumping 1 TTPs 2 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 29 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr_linux_amd64 (2).elf
    "/tmp/xmr_linux_amd64 (2).elf"
    1⤵
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:2528
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:2536
      • /usr/bin/true
        true
        3⤵
          PID:2537
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:2556
        • /tmp/xmrig/xmrig-6.21.3/xmrig
          /tmp/xmrig/xmrig-6.21.3/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:2557

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /tmp/xmrig/xmrig-6.21.3/SHA256SUMS
      Filesize

      150B

      MD5

      4f3be397a97fe6981754daeff1c2b77b

      SHA1

      251612464045242636103e61da4a0bc02c8fb99b

      SHA256

      1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

      SHA512

      a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/config.json
      Filesize

      2KB

      MD5

      66f38c96a4901e7b345787c447842b3e

      SHA1

      2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

      SHA256

      2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

      SHA512

      71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/config.json
      Filesize

      3KB

      MD5

      5924e26d7c34ff5f8094b7944f66ffb2

      SHA1

      beae12d3d55758b60c4033215a88a58505de2898

      SHA256

      00e833377862c6cd4064229f7678f542fe77f95ea71387f191cc77d203d92dca

      SHA512

      f954675f4538a512bd28d31599bbaf5d3ea9dd3a874fb2652a6a156e563c66b43b37060ecef392da3fe53112b0e4be3a4b1a0c8e9994d398d4b0fae10ef9a570

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/config.json
      Filesize

      3KB

      MD5

      594b5303509998d6a6f699bd74b654d0

      SHA1

      f1840b53ed53cc31cfab88e1e00fd46eff19f98d

      SHA256

      71fcf45a5f81face86011149fedbf9185a764783ec3b0849192ba5951fec708e

      SHA512

      76704697c66fb0bc1cbf15749e5b835ef7fe21ca388a702113ad647e638db506f7d7e8738a5e50b372abc0c82386bf0946a112a061c5c88183abbcec5c30de29

      Download Submit

    • /tmp/xmrig/xmrig-6.21.3/xmrig
      Filesize

      7.9MB

      MD5

      7429d24207b100f6c164bf4703b5941e

      SHA1

      a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

      SHA256

      72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

      SHA512

      7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

      Download Submit

    • /tmp/xmrig/xmrig.tar.gz
      Filesize

      3.3MB

      MD5

      06b8367fc7b84a666a561a6915a4501d

      SHA1

      d06991f03408390059df8fc387ac7923e4b5fb7a

      SHA256

      a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

      SHA512

      8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

      Download Submit