Overview

overview

10

Static

static

1

xmr_linux_amd64 (4)

ubuntu-18.04-amd64

10

xmr_linux_amd64 (4)

ubuntu-20.04-amd64

10

xmr_linux_amd64 (4)

ubuntu-22.04-amd64

10

xmr_linux_amd64 (4)

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    32s
  • max time network
    36s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    10-10-2024 21:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xmr_linux_amd64 (4)

  • Size

    9.1MB

  • MD5

    78a8cadaeade8826560e68057f751b82

  • SHA1

    354317e180688c01d2faad7ffd6970a9afd86a94

  • SHA256

    811510f00dabcd3a414015f7812c1516eb9a8471a4fec2150d7b42bdcd451bc1

  • SHA512

    ec576f085d83c9dba62a13290907733235d3c65781d77c93802ca0cb2aebc1eea9d9b69ae2532b8729b8ae8ca9104e964404feda46a683488710c2fefff59fa3

  • SSDEEP

    49152:6+fJxIlZGEB8SDBjuS+WzqZxg5TsRGofg1x+ThfGlEpyXFlV3BobTWHfU5E/qB/Y:6obTcljiWZeUkgYGlbbBOE/iaZH9

Score
10/10
xmrig_linuxantivmdefense_evasiondiscoveryevasionminerprivilege_escalationrootkit

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • Loads a kernel module 1 IoCs

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 1 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    evasion
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 28 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xmr_linux_amd64 (4)
    "/tmp/xmr_linux_amd64 (4)"
    1⤵
    • Modifies hosts file
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1487
    • /usr/bin/sudo
      sudo -n true
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:1494
    • /tmp/xmrig/xmrig-6.22.0/xmrig
      /tmp/xmrig/xmrig-6.22.0/xmrig
      2⤵
      • Executes dropped EXE
      • Checks hardware identifiers (DMI)
      • Reads hardware information
      • Checks CPU configuration
      • Reads CPU attributes
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1506
      • /bin/sh
        sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
        3⤵
          PID:1512
          • /sbin/modprobe
            /sbin/modprobe msr "allow_writes=on"
            4⤵
            • Loads a kernel module
            • Enumerates kernel/hardware configuration
            PID:1513

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /config/.config/openbox/autostart
      Filesize

      90B

      MD5

      dbc6fcef70ddc428bd6fed92d06902d6

      SHA1

      f5bf017e726674a6bc954552ba72615de1df1257

      SHA256

      271572941325c5bb6af86dfd2160a2e1358f7130535f88689a4a92ba2c6309fe

      SHA512

      0875636d796d3fb3f4a7930b041f70aec60ee2d11bddc22f5b93fb5ba045aa2bf353a8d0c8c789a7258da49ac099ffad8207344fd178aa85749eaf5504c3ad82

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/config.json
      Filesize

      4KB

      MD5

      5c6108e6bc4e612dd59aa1ce9ac909ff

      SHA1

      b66515c379ee4ebaf312b1d453d147527d3a83b2

      SHA256

      fa70f1a297f3ed7d2ef75598d4a1da3fb82d68fc14322fdcc0f29c909882a599

      SHA512

      b69b4b6f73e03f82854f449737a9a24a489b1231681a62a3853037443489ccc52a576f85a5acd4ab21c612c8768f7b0ade6815785293926e195dc93a46d2670b

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/config.json
      Filesize

      4KB

      MD5

      a0713f0517534dc9fab0c94a6d1a6486

      SHA1

      6884691135dda6ddafb89e7e5fdc01ef0ec46330

      SHA256

      fd7e4b6b70e1c25cc9f3a0ef8826e5b93af6b80affc5e9bc63dca69518ef4d8d

      SHA512

      c91deb8cf6bd4363b10c9e67a9a424cb7cadf53b764dddb8e5eb59fe323ae6c0d6c980a62a94d4058b75e1f2d5b926dccbc1738970e969d6943c7d3caeb1db1e

      Download Submit

    • /tmp/xmrig/xmrig-6.22.0/xmrig
      Filesize

      9.0MB

      MD5

      3d1f6bd959a6bdc423d43342dde28b56

      SHA1

      79266b5cc7c3762998e87411c56b6bd1a573b91f

      SHA256

      0d861bf1eafe3cd5d47197b2def17efb6853f2d0a5a46cafb289c013c449b33b

      SHA512

      b660cfad542a18a82f06080a51976ab7a355080572728f814b1b927e6956918b73172ecd58c5a9dcfe1af6759dc8bf9acbaa2595e6c10e0e44e7ade903e87439

      Download Submit