General

  • Target

    sh.sh

  • Size

    1KB

  • Sample

    241030-g4xe8swqgx

  • MD5

    fb5731a3a17d323bcc3347e401b1515d

  • SHA1

    1c239729b6556e96c34554b782cb79fc458d95d6

  • SHA256

    8ba52fa770913a0c43e08e45094f09c321abaf26efef35150ee22c393c460fb9

  • SHA512

    16ff9d2c0ecb1af8d2a2130af2522c49be2f267e7d18dbc6c6b2d91e14753ac689022da29069d3f6244530b0d24b7ab73d532a52a30ed5a228f5e838d0678881

Malware Config

Targets

    • Target

      sh.sh

    • Size

      1KB

    • MD5

      fb5731a3a17d323bcc3347e401b1515d

    • SHA1

      1c239729b6556e96c34554b782cb79fc458d95d6

    • SHA256

      8ba52fa770913a0c43e08e45094f09c321abaf26efef35150ee22c393c460fb9

    • SHA512

      16ff9d2c0ecb1af8d2a2130af2522c49be2f267e7d18dbc6c6b2d91e14753ac689022da29069d3f6244530b0d24b7ab73d532a52a30ed5a228f5e838d0678881

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Contacts a large (764029) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • XMRig Miner payload

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Reads AppArmor ptrace settings

      Discovery of allowed ptrace capabilities by AppArmor.

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    • Reads network interface configuration

      Fetches information about one or more active network interfaces.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks