Overview

overview

10

Static

static

1

xmr_linux_amd64

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    28s
  • max time network
    30s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    30-09-2024 21:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr_linux_amd64

  • Size

    8.8MB

  • MD5

    696180ee1b5a45a4897ebe78219cdbbf

  • SHA1

    aba713a4b818a908ecef92600385e101323a43d8

  • SHA256

    39e260ecea6351d0951be6d16f6eb3d243f22837d1f9bb47356d3a3320e30c69

  • SHA512

    870989e87d2cdd99d6252558c5a93124755cfc49c58cf8cf2a34eb5583d7870415949286de7b28ec6d9d7ea34a5ab437d5d0e8aaf9e664d968ea1cabd24cd261

  • SSDEEP

    49152:8zs7cjkjzBbeojVRCa11UmE8NgClMtyOt/4v0kBCYHujKkxfCyY3H95EbBuE3Z9e:asZXBi+Ucim9XMgOpc0k7AUEFj/+zd

Score
10/10
xmrig_linuxantivmcredential_accessdefense_evasiondiscoveryevasionminerprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 6 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • OS Credential Dumping 1 TTPs 7 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 7 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 24 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 64 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 7 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr_linux_amd64
    /tmp/xmr_linux_amd64
    1⤵
    • Modifies hosts file
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1404
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1447
      • /usr/bin/true
        true
        3⤵
          PID:1448
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1455
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1456
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1462
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1463
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1469
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1470
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1476
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          PID:1477
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1483
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1484
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1490
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1491

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /config/.config/openbox/autostart
      Filesize

      90B

      MD5

      dbc6fcef70ddc428bd6fed92d06902d6

      SHA1

      f5bf017e726674a6bc954552ba72615de1df1257

      SHA256

      271572941325c5bb6af86dfd2160a2e1358f7130535f88689a4a92ba2c6309fe

      SHA512

      0875636d796d3fb3f4a7930b041f70aec60ee2d11bddc22f5b93fb5ba045aa2bf353a8d0c8c789a7258da49ac099ffad8207344fd178aa85749eaf5504c3ad82

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/config.json
      Filesize

      4KB

      MD5

      5c6108e6bc4e612dd59aa1ce9ac909ff

      SHA1

      b66515c379ee4ebaf312b1d453d147527d3a83b2

      SHA256

      fa70f1a297f3ed7d2ef75598d4a1da3fb82d68fc14322fdcc0f29c909882a599

      SHA512

      b69b4b6f73e03f82854f449737a9a24a489b1231681a62a3853037443489ccc52a576f85a5acd4ab21c612c8768f7b0ade6815785293926e195dc93a46d2670b

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/config.json
      Filesize

      4KB

      MD5

      19e0d0e076d67ec3c92b25ecf277ca30

      SHA1

      2d45e4ee6c8e351ba8987b4ec24d2d837cb3e6b2

      SHA256

      62523337f548a18105c51be7db4f1c3b925fa2f389b04aa4f37ad98bf2234b5e

      SHA512

      362fd193aee9d64aa627fdbc46891d8a030a51c67422600fb305f4a34bbfd7d19582f427d9644042c71fdbf9156a30636c43fa24da3c7964b8edd48891e9cdd0

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/xmrig
      Filesize

      9.0MB

      MD5

      3d1f6bd959a6bdc423d43342dde28b56

      SHA1

      79266b5cc7c3762998e87411c56b6bd1a573b91f

      SHA256

      0d861bf1eafe3cd5d47197b2def17efb6853f2d0a5a46cafb289c013c449b33b

      SHA512

      b660cfad542a18a82f06080a51976ab7a355080572728f814b1b927e6956918b73172ecd58c5a9dcfe1af6759dc8bf9acbaa2595e6c10e0e44e7ade903e87439

      Download Submit