Overview

overview

10

Static

static

1

sa.sh

ubuntu-18.04-amd64

10

sa.sh

debian-9-armhf

10

sa.sh

debian-9-mips

10

sa.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sa.sh

  • Size

    438B

  • Sample

    241229-epmldaskby

  • MD5

    52f6ef322dd61383cc5f03bba971ecc1

  • SHA1

    a540ec9917e63a178aa44b3f3570a54ff8c88135

  • SHA256

    82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97

  • SHA512

    c17b540e81ca673cfb39cedb1417bfebb0367d61f9f9315710713bc0167cfb953b2b0fdec2bad0435c4ac423e41935fac7fa76ceb288f07174273b9f32f1d938

Score
10/10
xmrigxmrig_linuxantivmdefense_evasiondiscoverylinuxminer

Malware Config

Targets

    • Target

      sa.sh

    • Size

      438B

    • MD5

      52f6ef322dd61383cc5f03bba971ecc1

    • SHA1

      a540ec9917e63a178aa44b3f3570a54ff8c88135

    • SHA256

      82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97

    • SHA512

      c17b540e81ca673cfb39cedb1417bfebb0367d61f9f9315710713bc0167cfb953b2b0fdec2bad0435c4ac423e41935fac7fa76ceb288f07174273b9f32f1d938

    Score
    10/10
    xmrigxmrig_linuxantivmdefense_evasiondiscoveryminer

    • XMRig Miner payload

      miner

    • Xmrig family

      xmrig

    • Xmrig_linux family

      xmrig_linux

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Executes dropped EXE

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks