xmrig | 89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5 | Triage

Resubmissions

28/03/2025, 06:27

250328-g7715ssxfz 10

28/03/2025, 06:21

250328-g4j5xasxdx 10

Sharing

General

Target

ubuntu.sh
Size

748B
Sample

250328-g7715ssxfz
MD5

229c643e9b0c79281884b70efba08109
SHA1

442e01e0af2650eb9419d443b19ab40779171d74
SHA256

89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5
SHA512

88742f501ddb450ad04f09b3a16418d9fe9a541792c7bf68f0db63431e2e5d2c2132e45d60f807792625facad074feb351a015f98dc690833aff14eb2e993559

Score

10^/10

xmrig xmrig_linux android antivm credential_access defense_evasion discovery execution linux miner persistence privilege_escalation

Malware Config

Targets

- Target
  
  ubuntu.sh
- Size
  
  748B
- MD5
  
  229c643e9b0c79281884b70efba08109
- SHA1
  
  442e01e0af2650eb9419d443b19ab40779171d74
- SHA256
  
  89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5
- SHA512
  
  88742f501ddb450ad04f09b3a16418d9fe9a541792c7bf68f0db63431e2e5d2c2132e45d60f807792625facad074feb351a015f98dc690833aff14eb2e993559
Score

10^/10

defense_evasion discovery privilege_escalation xmrig xmrig_linux miner antivm credential_access execution persistence
- XMRig Miner payload
  miner
- Xmrig family
  xmrig
- Xmrig_linux family
  xmrig_linux
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
- Writes file to system bin folder
behavioral1 behavioral10 behavioral11 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Sudo and Sudo Caching

Defense Evasion

Abuse Elevation Control Mechanism

Sudo and Sudo Caching

Indicator Removal

Clear Linux or Mac System Logs

Virtualization/Sandbox Evasion

System Checks

Credential Access

OS Credential Dumping

/etc/passwd and /etc/shadow

Discovery

System Information Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Software Deployment Tools

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

xmrigxmrig_linuxdefense_evasiondiscoveryminerprivilege_escalation

behavioral9

xmrigxmrig_linuxantivmcredential_accessdefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalation

behavioral10

defense_evasiondiscoveryprivilege_escalation

behavioral11

defense_evasiondiscoveryprivilege_escalation