General

  • Target

    63356ecacc71f1a4267dd00dbd4769be86c255cfa267658ad6e1e6bd7bf80446.sh

  • Size

    1KB

  • Sample

    241109-c9me1avmev

  • MD5

    1bf0e6d92f2e0ef621ceeb072eed6b11

  • SHA1

    6cce0a196ec3af2df1cd9d38b053ac159add344b

  • SHA256

    63356ecacc71f1a4267dd00dbd4769be86c255cfa267658ad6e1e6bd7bf80446

  • SHA512

    e922ba2c485d302e5b64d7f25249e464cd5c8579a780ce8f6750aad798add89ad43097655980068eef707144ec1ba17fa7a21651b140b51cbc607beee4e90656

Malware Config

Targets

    • Target

      63356ecacc71f1a4267dd00dbd4769be86c255cfa267658ad6e1e6bd7bf80446.sh

    • Size

      1KB

    • MD5

      1bf0e6d92f2e0ef621ceeb072eed6b11

    • SHA1

      6cce0a196ec3af2df1cd9d38b053ac159add344b

    • SHA256

      63356ecacc71f1a4267dd00dbd4769be86c255cfa267658ad6e1e6bd7bf80446

    • SHA512

      e922ba2c485d302e5b64d7f25249e464cd5c8579a780ce8f6750aad798add89ad43097655980068eef707144ec1ba17fa7a21651b140b51cbc607beee4e90656

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Contacts a large (943805) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • XMRig Miner payload

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

    • Executes dropped EXE

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Reads AppArmor ptrace settings

      Discovery of allowed ptrace capabilities by AppArmor.

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    • Reads network interface configuration

      Fetches information about one or more active network interfaces.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks