Overview

overview

10

Static

static

1

minstall.sh

ubuntu-18.04-amd64

10

minstall.sh

debian-9-armhf

10

minstall.sh

debian-9-mips

10

minstall.sh

debian-9-mipsel

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    minstall.sh

  • Size

    1KB

  • Sample

    250330-x6qngaxps6

  • MD5

    815e8f0fa36c902d98a7fc43b325f872

  • SHA1

    0def204bd8a94fc477a98054c0f5d374146362e7

  • SHA256

    eb4d5d21d11d867ae53ef676fe24aeccf6f54e68ab0c5337ce38921940cf97d1

  • SHA512

    feb03aeefa483dcc924fb0f0478e322c19f8f6d483214af0232c0a7c0197ed94781866e1a377db82ad978a0b5d94b8fc364b538b2f910cb717cd5d6e8e8d6190

Score
10/10
xmrigxmrig_linuxantivmdiscoverylinuxminerrootkit

Malware Config

Targets

    • Target

      minstall.sh

    • Size

      1KB

    • MD5

      815e8f0fa36c902d98a7fc43b325f872

    • SHA1

      0def204bd8a94fc477a98054c0f5d374146362e7

    • SHA256

      eb4d5d21d11d867ae53ef676fe24aeccf6f54e68ab0c5337ce38921940cf97d1

    • SHA512

      feb03aeefa483dcc924fb0f0478e322c19f8f6d483214af0232c0a7c0197ed94781866e1a377db82ad978a0b5d94b8fc364b538b2f910cb717cd5d6e8e8d6190

    Score
    10/10
    xmrigxmrig_linuxantivmdiscoveryminerrootkit

    • XMRig Miner payload

      miner

    • Xmrig family

      xmrig

    • Xmrig_linux family

      xmrig_linux

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig_linux

    • Executes dropped EXE

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

      discovery
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks