Analysis
-
max time kernel
40s -
max time network
44s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
-
submitted
10-10-2024 21:28
General
-
Target
xmr_linux_amd64 (4)
-
Size
9.1MB
-
MD5
78a8cadaeade8826560e68057f751b82
-
SHA1
354317e180688c01d2faad7ffd6970a9afd86a94
-
SHA256
811510f00dabcd3a414015f7812c1516eb9a8471a4fec2150d7b42bdcd451bc1
-
SHA512
ec576f085d83c9dba62a13290907733235d3c65781d77c93802ca0cb2aebc1eea9d9b69ae2532b8729b8ae8ca9104e964404feda46a683488710c2fefff59fa3
-
SSDEEP
49152:6+fJxIlZGEB8SDBjuS+WzqZxg5TsRGofg1x+ThfGlEpyXFlV3BobTWHfU5E/qB/Y:6obTcljiWZeUkgYGlbbBOE/iaZH9
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
-
OS Credential Dumping 1 TTPs 2 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs
Abuse sudo or cached sudo credentials to execute code.
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 46 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 29 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/xmr_linux_amd64 (4)"/tmp/xmr_linux_amd64 (4)"1⤵
- Modifies hosts file
- Reads list of loaded kernel modules
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/bin/sudosudo -n true2⤵
- OS Credential Dumping
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
-
/usr/bin/truetrue3⤵
-
/usr/bin/sudosudo -n /tmp/xmrig/xmrig-6.22.0/xmrig2⤵
- OS Credential Dumping
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
-
/tmp/xmrig/xmrig-6.22.0/xmrig/tmp/xmrig/xmrig-6.22.0/xmrig3⤵
- Executes dropped EXE
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90B
MD5dbc6fcef70ddc428bd6fed92d06902d6
SHA1f5bf017e726674a6bc954552ba72615de1df1257
SHA256271572941325c5bb6af86dfd2160a2e1358f7130535f88689a4a92ba2c6309fe
SHA5120875636d796d3fb3f4a7930b041f70aec60ee2d11bddc22f5b93fb5ba045aa2bf353a8d0c8c789a7258da49ac099ffad8207344fd178aa85749eaf5504c3ad82
-
Filesize
4KB
MD55c6108e6bc4e612dd59aa1ce9ac909ff
SHA1b66515c379ee4ebaf312b1d453d147527d3a83b2
SHA256fa70f1a297f3ed7d2ef75598d4a1da3fb82d68fc14322fdcc0f29c909882a599
SHA512b69b4b6f73e03f82854f449737a9a24a489b1231681a62a3853037443489ccc52a576f85a5acd4ab21c612c8768f7b0ade6815785293926e195dc93a46d2670b
-
Filesize
4KB
MD5a8f905278b8114ef2a067c5058cd749b
SHA161bdd66ffd95ceab5786b838311a29bed5fbb75f
SHA256c8314a547bbfeaadc74527141f3acdd2f4ffcb93aded20c9d62407979a6b5300
SHA512f6fe35a5f9aa5be2a8414378933ac62c5d74a2b7ad182920ea1df1375a2770b2c4ed98870f7dca1707af93d8f2e055ea60222970db46c5164c578e2795b0eb8c
-
Filesize
9.0MB
MD53d1f6bd959a6bdc423d43342dde28b56
SHA179266b5cc7c3762998e87411c56b6bd1a573b91f
SHA2560d861bf1eafe3cd5d47197b2def17efb6853f2d0a5a46cafb289c013c449b33b
SHA512b660cfad542a18a82f06080a51976ab7a355080572728f814b1b927e6956918b73172ecd58c5a9dcfe1af6759dc8bf9acbaa2595e6c10e0e44e7ade903e87439