General
- Target name.zip
- Size 3.9MB
- Sample241021-n55xbsshjb
- SHA256 e0167b29311f359344fe2879d8de3e8f5eb4c4d5a54bf0d46406d1d7af0cd2ff
Score
10/10
Malware Config
Targets
-
- Target kermine
- Size 1.3MB
- SHA256 7f2b4e30c6ae7c56c0bc861f920bca6b52183b3e8bc30347739c6591bdfaa589
Score10/10-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Deletes journal logs
Deletes systemd journal logs. Likely to evade detection.
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
OS Credential Dumping
Adversaries may attempt to dump credentials to use it in password cracking.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads list of loaded kernel modules
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
MITRE ATT&CK Enterprise v15
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Indicator Removal
2Clear Linux or Mac System Logs
2Virtualization/Sandbox Evasion
1