Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240729-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/11/2024, 02:56
Behavioral task
behavioral1
Sample
.__cli__
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
.__min__
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
.__min__m
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
0 signatures
150 seconds
General
- Target .__min__
- Size 8.2MB
- Sample241104-de7m5asand
- SHA256 71cf150028e4b67bcd8cb50c4aa86eecab1615195cf6a45024e9c4e55aa1e7fd
- MD5 e63c67b5e3d7ed50f545f169bbabb85d
- SHA1 dc257558381a518aec15ee646364eda18da3ad32
- SHA512 a8c7a967a391f7799952ee3ea530cf5e62835860956586f1ee976b6089aead991aa1379a70e7190806e0999d53774432243ecb58b7a2878090f836068ba9a76e
- SSDEEP 98304:MgbD211H7WHt+HQNymofADvDvD09UG6nXxTu3xxmVPxS5Af/nHi8Z7KJiWPE3PEf:SVZ6sbVIHCRjQvr1s
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Xmrig_linux family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name .__min__ File opened for reading /sys/devices/virtual/dmi/id/board_vendor .__min__ File opened for reading /sys/devices/virtual/dmi/id/bios_vendor .__min__ File opened for reading /sys/devices/virtual/dmi/id/sys_vendor .__min__ - Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_serial .__min__ File opened for reading /sys/devices/virtual/dmi/id/product_uuid .__min__ File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag .__min__ File opened for reading /sys/devices/virtual/dmi/id/chassis_type .__min__ File opened for reading /sys/devices/virtual/dmi/id/bios_version .__min__ File opened for reading /sys/devices/virtual/dmi/id/board_name .__min__ File opened for reading /sys/devices/virtual/dmi/id/chassis_version .__min__ File opened for reading /sys/devices/virtual/dmi/id/bios_date .__min__ File opened for reading /sys/devices/virtual/dmi/id/board_serial .__min__ File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor .__min__ File opened for reading /sys/devices/virtual/dmi/id/chassis_serial .__min__ File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag .__min__ File opened for reading /sys/devices/virtual/dmi/id/product_version .__min__ File opened for reading /sys/devices/virtual/dmi/id/board_version .__min__ - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo .__min__ - Reads CPU attributes 1 TTPs 46 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size .__min__ File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus .__min__ File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition .__min__ File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition .__min__ File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/online .__min__ File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map .__min__ File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity .__min__ File opened for reading /sys/devices/system/cpu/possible .__min__ - Enumerates kernel/hardware configuration 1 TTPs 21 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus .__min__ File opened for reading /sys/kernel/mm/hugepages .__min__ File opened for reading /sys/devices/system/node/node0/cpumap .__min__ File opened for reading /sys/devices/system/node/node0/hugepages .__min__ File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency .__min__ File opened for reading /sys/devices/virtual/dmi/id .__min__ File opened for reading /sys/devices/system/cpu .__min__ File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages .__min__ File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages .__min__ File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency .__min__ File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems .__min__ File opened for reading /sys/devices/cpu_core/cpus .__min__ File opened for reading /sys/devices/system/node/node0/meminfo .__min__ File opened for reading /sys/devices/system/node/node0/access0/initiators .__min__ File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth .__min__ File opened for reading /sys/bus/soc/devices .__min__ File opened for reading /sys/devices/cpu_atom/cpus .__min__ File opened for reading /sys/devices/system/node/online .__min__ File opened for reading /sys/bus/dax/devices .__min__ File opened for reading /sys/devices/system/node/node0/access1/initiators .__min__ File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth .__min__ -
description ioc Process File opened for reading /proc/cmdline .__min__ File opened for reading /proc/self/cpuset .__min__ File opened for reading /proc/meminfo .__min__ File opened for reading /proc/driver/nvidia/gpus .__min__