747091fd60a9c41ff26d3878bac923c9c14b5472238874754577e14d47b8cba7

Resubmissions

02-12-2024 02:52

241202-dcyx7s1lfk 10

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
02-12-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xrx/init.sh
Size

1020KB
MD5

42693670c71a529a11e81943f5b36c5b
SHA1

9026cc25786215bba3bc06c4875f7da410425f8c
SHA256

eb2329422e52901d0bea0c0fcc4b3a6d1923ef278a96d2a14ab1839882cd0ecf
SHA512

a92d9bd9cd4c1c81a2e8042a9b7c31badba5e033743f34fb851b60350c5833afb246c64fc982112afecad9b1fc48bfdeab16a7bda169b4a635a8922549067d82
SSDEEP

12288:ztLJzlNZDaY9FnavUIqEhgvmKe36myOP7/67LN5kwrHNq9EnE:zvxNZD7FnavUILhgvJeb/67LFLNq9

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1166/cmdline	pidof
File opened for reading	/proc/1187/stat	pidof
File opened for reading	/proc/74/cmdline	pidof
File opened for reading	/proc/110/cmdline	pidof
File opened for reading	/proc/843/cmdline	pidof
File opened for reading	/proc/1042/stat	pidof
File opened for reading	/proc/1090/cmdline	pidof
File opened for reading	/proc/1092/stat	pidof
File opened for reading	/proc/1494/stat	pidof
File opened for reading	/proc/1583/stat	pidof
File opened for reading	/proc/415/stat	pidof
File opened for reading	/proc/510/stat	pidof
File opened for reading	/proc/1078/cmdline	pidof
File opened for reading	/proc/1442/stat	pidof
File opened for reading	/proc/427/stat	pidof
File opened for reading	/proc/1455/stat	pidof
File opened for reading	/proc/1494/cmdline	pidof
File opened for reading	/proc/4/stat	pidof
File opened for reading	/proc/119/stat	pidof
File opened for reading	/proc/197/cmdline	pidof
File opened for reading	/proc/198/stat	pidof
File opened for reading	/proc/783/cmdline	pidof
File opened for reading	/proc/1392/stat	pidof
File opened for reading	/proc/1319/stat	pidof
File opened for reading	/proc/1347/stat	pidof
File opened for reading	/proc/27/cmdline	pidof
File opened for reading	/proc/83/stat	pidof
File opened for reading	/proc/212/stat	pidof
File opened for reading	/proc/412/stat	pidof
File opened for reading	/proc/776/cmdline	pidof
File opened for reading	/proc/1088/stat	pidof
File opened for reading	/proc/92/cmdline	pidof
File opened for reading	/proc/197/stat	pidof
File opened for reading	/proc/1160/stat	pidof
File opened for reading	/proc/1165/cmdline	pidof
File opened for reading	/proc/1363/stat	pidof
File opened for reading	/proc/1135/cmdline	pidof
File opened for reading	/proc/4/cmdline	pidof
File opened for reading	/proc/90/cmdline	pidof
File opened for reading	/proc/95/stat	pidof
File opened for reading	/proc/586/stat	pidof
File opened for reading	/proc/594/stat	pidof
File opened for reading	/proc/676/cmdline	pidof
File opened for reading	/proc/634/stat	pidof
File opened for reading	/proc/635/stat	pidof
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/78/cmdline	pidof
File opened for reading	/proc/91/cmdline	pidof
File opened for reading	/proc/96/cmdline	pidof
File opened for reading	/proc/102/stat	pidof
File opened for reading	/proc/206/cmdline	pidof
File opened for reading	/proc/676/stat	pidof
File opened for reading	/proc/963/stat	pidof
File opened for reading	/proc/1183/cmdline	pidof
File opened for reading	/proc/1244/cmdline	pidof
File opened for reading	/proc/11/cmdline	pidof
File opened for reading	/proc/314/stat	pidof
File opened for reading	/proc/415/cmdline	pidof
File opened for reading	/proc/637/stat	pidof
File opened for reading	/proc/1322/cmdline	pidof
File opened for reading	/proc/79/cmdline	pidof
File opened for reading	/proc/195/stat	pidof
File opened for reading	/proc/1101/stat	pidof
File opened for reading	/proc/1162/cmdline	pidof

/tmp/xrx/init.sh
/tmp/xrx/init.sh
1⤵
PID:1579

/bin/bash
/tmp/xrx/init.sh -c "exec '/tmp/xrx/init.sh' \"\$@\"" /tmp/xrx/init.sh
1⤵
PID:1579

/tmp/xrx/init.sh
/tmp/xrx/init.sh
1⤵
PID:1579

/bin/bash
/tmp/xrx/init.sh -c " #!/bin/bash if [[ \$(cat config.json | grep xxcountxx) ]]; then echo \"configuring miner\" sed -i \"s/xxcountxx/\$(nproc)/g\" config.json else echo \"using preconfigured miner\" fi PID=\$(pidof xrx) if [ \$# -eq 0 ]; then ##if no arguments if [ -z \"\${PID}\" ]; then ./xrx </dev/null &>/dev/null & disown -h %1 echo \"miner online\" else echo \"miner already online\" fi fi " /tmp/xrx/init.sh
1⤵
PID:1579
- /usr/bin/grep
  grep xxcountxx
  2⤵
  PID:1582
- /usr/bin/cat
  cat config.json
  2⤵
  PID:1581
- /usr/bin/pidof
  pidof xrx
  2⤵
  - Reads runtime system information
  PID:1583

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads