xmrig_linux | 16601646d8a77944267e1011652f3b0c48a2c245a06986a0a9aca3afb87c7b11

Analysis

max time kernel
30s
max time network
33s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
14-10-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xmr_linux_amd64
Size

9.4MB
MD5

355086335423b9c48817e688e111a220
SHA1

b054fc63f8341f2837ad0f94af24ffc980c1ed57
SHA256

16601646d8a77944267e1011652f3b0c48a2c245a06986a0a9aca3afb87c7b11
SHA512

74e4f1933ee573c3f751fb96ec3a7b3db016af9ab7d19f5ef0191d2325feaa4923798aa52a2374efee191da6475e412c542d2c379e0f295f58287a561dfa10f8
SSDEEP

49152:Hu3qHoyXKo3Rhk9DO12pTZjCuXuNZHFWsdK0dpZQI9Y1IbgOSsQVDxTx/pQ5Enjh:O6IqaqqlEc6pCml59S1GEjAPqPhl

Score

10^/10

xmrig_linux antivm credential_access defense_evasion discovery evasion miner privilege_escalation

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
File opened for modification	/etc/hosts	xmr_linux_amd64

OS Credential Dumping 1 TTPs 5 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	sudo
File opened for reading	/etc/shadow	sudo
File opened for reading	/etc/shadow	sudo
File opened for reading	/etc/shadow	sudo
File opened for reading	/etc/shadow	sudo

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 5 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1443	sudo
1446	sudo
1447	sudo
1449	sudo
1450	sudo

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
2	api.ipify.org
3	api.ipify.org

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/modules	xmr_linux_amd64

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	xmr_linux_amd64

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	xmr_linux_amd64

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	xmr_linux_amd64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/stat	xmr_linux_amd64
File opened for reading	/proc/949/stat	xmr_linux_amd64
File opened for reading	/proc/1177/cmdline	xmr_linux_amd64
File opened for reading	/proc/92/cmdline	xmr_linux_amd64
File opened for reading	/proc/176/comm	xmr_linux_amd64
File opened for reading	/proc/941/comm	xmr_linux_amd64
File opened for reading	/proc/950/status	xmr_linux_amd64
File opened for reading	/proc/1089/comm	xmr_linux_amd64
File opened for reading	/proc/77/stat	xmr_linux_amd64
File opened for reading	/proc/504/stat	xmr_linux_amd64
File opened for reading	/proc/2/comm	xmr_linux_amd64
File opened for reading	/proc/1145/comm	xmr_linux_amd64
File opened for reading	/proc/70/comm	xmr_linux_amd64
File opened for reading	/proc/617/cmdline	xmr_linux_amd64
File opened for reading	/proc/1046/comm	xmr_linux_amd64
File opened for reading	/proc/5/cmdline	xmr_linux_amd64
File opened for reading	/proc/9/comm	xmr_linux_amd64
File opened for reading	/proc/75/comm	xmr_linux_amd64
File opened for reading	/proc/175/comm	xmr_linux_amd64
File opened for reading	/proc/1089/cmdline	xmr_linux_amd64
File opened for reading	/proc/82/stat	xmr_linux_amd64
File opened for reading	/proc/242/stat	xmr_linux_amd64
File opened for reading	/proc/1446/stat	xmr_linux_amd64
File opened for reading	/proc/694/stat	xmr_linux_amd64
File opened for reading	/proc/857/comm	xmr_linux_amd64
File opened for reading	/proc/1312/comm	xmr_linux_amd64
File opened for reading	/proc/73/stat	xmr_linux_amd64
File opened for reading	/proc/91/stat	xmr_linux_amd64
File opened for reading	/proc/158/stat	xmr_linux_amd64
File opened for reading	/proc/1126/comm	xmr_linux_amd64
File opened for reading	/proc/163/stat	xmr_linux_amd64
File opened for reading	/proc/498/stat	xmr_linux_amd64
File opened for reading	/proc/779/comm	xmr_linux_amd64
File opened for reading	/proc/200/cmdline	xmr_linux_amd64
File opened for reading	/proc/1222/cmdline	xmr_linux_amd64
File opened for reading	/proc/22/stat	xmr_linux_amd64
File opened for reading	/proc/1/cmdline	xmr_linux_amd64
File opened for reading	/proc/6/comm	xmr_linux_amd64
File opened for reading	/proc/396/comm	xmr_linux_amd64
File opened for reading	/proc/996/status	xmr_linux_amd64
File opened for reading	/proc/1398/comm	xmr_linux_amd64
File opened for reading	/proc/12/comm	xmr_linux_amd64
File opened for reading	/proc/13/comm	xmr_linux_amd64
File opened for reading	/proc/140/comm	xmr_linux_amd64
File opened for reading	/proc/496/stat	xmr_linux_amd64
File opened for reading	/proc/24/comm	xmr_linux_amd64
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/85/stat	xmr_linux_amd64
File opened for reading	/proc/93/stat	xmr_linux_amd64
File opened for reading	/proc/519/cmdline	xmr_linux_amd64
File opened for reading	/proc/762/comm	xmr_linux_amd64
File opened for reading	/proc/8/cmdline	xmr_linux_amd64
File opened for reading	/proc/21/comm	xmr_linux_amd64
File opened for reading	/proc/270/cmdline	xmr_linux_amd64
File opened for reading	/proc/439/comm	xmr_linux_amd64
File opened for reading	/proc/1074/status	xmr_linux_amd64
File opened for reading	/proc/1222/status	xmr_linux_amd64
File opened for reading	/proc/1400/cmdline	xmr_linux_amd64
File opened for reading	/proc/93/cmdline	xmr_linux_amd64
File opened for reading	/proc/242/status	xmr_linux_amd64
File opened for reading	/proc/242/cmdline	xmr_linux_amd64
File opened for reading	/proc/1091/stat	xmr_linux_amd64
File opened for reading	/proc/81/cmdline	xmr_linux_amd64
File opened for reading	/proc/201/comm	xmr_linux_amd64

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig/xmrig-6.22.0/config.json	xmr_linux_amd64

/tmp/xmr_linux_amd64
/tmp/xmr_linux_amd64
1⤵
- Modifies hosts file
- Reads list of loaded kernel modules
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1400
- /usr/bin/sudo
  sudo -n true
  2⤵
  - OS Credential Dumping
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1443
- - /usr/bin/true
    true
    3⤵
    PID:1444
- /usr/bin/chattr
  chattr +i /tmp/xmrig/xmrig-6.22.0/xmrig
  2⤵
  PID:1445
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
  2⤵
  - OS Credential Dumping
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1446
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
  2⤵
  - OS Credential Dumping
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1447
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
  2⤵
  - OS Credential Dumping
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1449
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.22.0/xmrig
  2⤵
  - OS Credential Dumping
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1450

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/config/.config/openbox/autostart

Filesize
90B

MD5
dbc6fcef70ddc428bd6fed92d06902d6

SHA1
f5bf017e726674a6bc954552ba72615de1df1257

SHA256
271572941325c5bb6af86dfd2160a2e1358f7130535f88689a4a92ba2c6309fe

SHA512
0875636d796d3fb3f4a7930b041f70aec60ee2d11bddc22f5b93fb5ba045aa2bf353a8d0c8c789a7258da49ac099ffad8207344fd178aa85749eaf5504c3ad82

Download Submit
/tmp/xmrig/xmrig-6.22.0/config.json

Filesize
4KB

MD5
5c6108e6bc4e612dd59aa1ce9ac909ff

SHA1
b66515c379ee4ebaf312b1d453d147527d3a83b2

SHA256
fa70f1a297f3ed7d2ef75598d4a1da3fb82d68fc14322fdcc0f29c909882a599

SHA512
b69b4b6f73e03f82854f449737a9a24a489b1231681a62a3853037443489ccc52a576f85a5acd4ab21c612c8768f7b0ade6815785293926e195dc93a46d2670b

Download Submit
/tmp/xmrig/xmrig-6.22.0/config.json

Filesize
4KB

MD5
485e924da1aab216fd14095e5dd942d9

SHA1
7edb0da85c162489673a0a9c25bc015dc52501ad

SHA256
d868d955e406f2b2c3e9f601a63d26461d8671ee0cc8ec4c6c05d64104c6b6ca

SHA512
a8c9dbf80d2682ef831c5458d516adedceaadfb00a01f438cdf6a43d4f57a599fed22c5b24f095208bc17fb5411a97f2767a1feb80cff136c868b40e2a3b2a3a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads