Overview

overview

10

Static

static

1

xmrlinuxamd64

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    01-10-2024 08:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmrlinuxamd64

  • Size

    8.8MB

  • MD5

    696180ee1b5a45a4897ebe78219cdbbf

  • SHA1

    aba713a4b818a908ecef92600385e101323a43d8

  • SHA256

    39e260ecea6351d0951be6d16f6eb3d243f22837d1f9bb47356d3a3320e30c69

  • SHA512

    870989e87d2cdd99d6252558c5a93124755cfc49c58cf8cf2a34eb5583d7870415949286de7b28ec6d9d7ea34a5ab437d5d0e8aaf9e664d968ea1cabd24cd261

  • SSDEEP

    49152:8zs7cjkjzBbeojVRCa11UmE8NgClMtyOt/4v0kBCYHujKkxfCyY3H95EbBuE3Z9e:asZXBi+Ucim9XMgOpc0k7AUEFj/+zd

Score
10/10
xmrig_linuxantivmcredential_accessdefense_evasiondiscoveryevasionminerprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • OS Credential Dumping 1 TTPs 2 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 29 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmrlinuxamd64
    /tmp/xmrlinuxamd64
    1⤵
    • Modifies hosts file
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1587
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:1607
      • /usr/bin/true
        true
        3⤵
          PID:1608
      • /usr/bin/sudo
        sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:1610
        • /tmp/xmrig/xmrig-6.22.0/xmrig
          /tmp/xmrig/xmrig-6.22.0/xmrig
          3⤵
          • Executes dropped EXE
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1611

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /config/.config/openbox/autostart
      Filesize

      90B

      MD5

      dbc6fcef70ddc428bd6fed92d06902d6

      SHA1

      f5bf017e726674a6bc954552ba72615de1df1257

      SHA256

      271572941325c5bb6af86dfd2160a2e1358f7130535f88689a4a92ba2c6309fe

      SHA512

      0875636d796d3fb3f4a7930b041f70aec60ee2d11bddc22f5b93fb5ba045aa2bf353a8d0c8c789a7258da49ac099ffad8207344fd178aa85749eaf5504c3ad82

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/config.json
      Filesize

      4KB

      MD5

      5c6108e6bc4e612dd59aa1ce9ac909ff

      SHA1

      b66515c379ee4ebaf312b1d453d147527d3a83b2

      SHA256

      fa70f1a297f3ed7d2ef75598d4a1da3fb82d68fc14322fdcc0f29c909882a599

      SHA512

      b69b4b6f73e03f82854f449737a9a24a489b1231681a62a3853037443489ccc52a576f85a5acd4ab21c612c8768f7b0ade6815785293926e195dc93a46d2670b

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/config.json
      Filesize

      4KB

      MD5

      ad591d097f5fea14a2b6ae757c9bd1d5

      SHA1

      aff8790f72f4bbbdc00ce8b87518573f7986ca07

      SHA256

      0cfd1af6b4282a0f4a2341c51e0c9bb270e577558e925312edc5aa91ea80e2f1

      SHA512

      84db1204e9cd5f1b35d7572269287788def04f41e4c256b7585a1f9c67bcf5f54f139fb68ff84f36205945413bf4b91968aa3f2b272a2d3b4a48f1ec23dce788

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/xmrig
      Filesize

      9.0MB

      MD5

      3d1f6bd959a6bdc423d43342dde28b56

      SHA1

      79266b5cc7c3762998e87411c56b6bd1a573b91f

      SHA256

      0d861bf1eafe3cd5d47197b2def17efb6853f2d0a5a46cafb289c013c449b33b

      SHA512

      b660cfad542a18a82f06080a51976ab7a355080572728f814b1b927e6956918b73172ecd58c5a9dcfe1af6759dc8bf9acbaa2595e6c10e0e44e7ade903e87439

      Download Submit