General
-
Target
x86_64.elf
-
Size
1.6MB
-
Sample
250202-y2q9wayphk
-
MD5
761a337ec4059809eb319e0502995aaf
-
SHA1
d65c6f9b5ad0e2c2f4ffdb1a927124d66569ef7a
-
SHA256
9c4743a801c333153c7251abbaedb0916ba9b07950a1cf0ececc93276956c4f6
-
SHA512
40b9a9a7ceef78a0d130632f91e56edebec69599b513536881ca3a0d8603ea23749c94bc32c753ad9b3d66bf11fd837d5a4e95a7b7d8ecc52db7bb716a0105c6
-
SSDEEP
49152:94Ydz1ph3JUzzhMHkfCY5D4CC/22BauQCj8lR:eYdz1ptuzYcFnuT5JoR
Malware Config
Targets
-
-
Target
x86_64.elf
-
Size
1.6MB
-
MD5
761a337ec4059809eb319e0502995aaf
-
SHA1
d65c6f9b5ad0e2c2f4ffdb1a927124d66569ef7a
-
SHA256
9c4743a801c333153c7251abbaedb0916ba9b07950a1cf0ececc93276956c4f6
-
SHA512
40b9a9a7ceef78a0d130632f91e56edebec69599b513536881ca3a0d8603ea23749c94bc32c753ad9b3d66bf11fd837d5a4e95a7b7d8ecc52db7bb716a0105c6
-
SSDEEP
49152:94Ydz1ph3JUzzhMHkfCY5D4CC/22BauQCj8lR:eYdz1ptuzYcFnuT5JoR
Score10/10-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (2390888) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-