Overview

overview

10

Static

static

10

kermine

ubuntu-24.04-amd64

10

Resubmissions

21/10/2024, 12:12

241021-pdcl5stbje10

21/10/2024, 11:59

241021-n55xbsshjb10

19/10/2024, 11:43

241019-nvrlyswdrn10

19/10/2024, 03:15

241019-drzs2swcrr10

19/10/2024, 03:03

241019-dj7tpavhrp10

18/10/2024, 09:09

241018-k4fdhaycqc10

Sharing

Copy URL Twitter E-mail

General

  • Target
    name.zip
  • Size 3.9MB
  • Sample241021-pdcl5stbje
  • SHA256 e0167b29311f359344fe2879d8de3e8f5eb4c4d5a54bf0d46406d1d7af0cd2ff
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigxmrig_linuxcredential_accessdefense_evasiondiscoveryevasionexecutionlinuxminerprivilege_escalationrootkit

Malware Config

Targets

    • Target
      kermine
    • Size 1.3MB
    • SHA256 7f2b4e30c6ae7c56c0bc861f920bca6b52183b3e8bc30347739c6591bdfaa589
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xmrig_linuxcredential_accessdefense_evasiondiscoveryevasionexecutionminerprivilege_escalationrootkit

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Deletes journal logs

      Deletes systemd journal logs. Likely to evade detection.

      evasion

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • OS Credential Dumping

      Adversaries may attempt to dump credentials to use it in password cracking.

      credential_access

    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching

      Abuse sudo or cached sudo credentials to execute code.

      privilege_escalationdefense_evasion

    • Deletes log files

      Deletes log files on the system.

      defense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads list of loaded kernel modules

      Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

      evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks