Extracted

• • Target
    ionetworks.arm6.elf
  • Size 135KB
  • SHA256 13f166bc0c57ed6f23acf5613c8366e0d4cfab1ca97b2689a841d48b9f237a14
  • MD5 fb765baa0546207256251312de8ed2eb
  • SHA1 a94a9e0e90b7fdc248400367d8d7abefdcd866ac
  • SHA512 f15043c844434658341835978ac8ad59821686f89979d4c33d9acdb72849bdc419c9f403754328300a3ede84882ef31d0b90c59e33a6d4414e1925b22130e6c6
  • SSDEEP 3072:A5upxw7bIfTzhm32x8E9laJE2thjq3BHoFdGP5hMH2A0DXfgwjWlmyhQaS+pg7J:ACeE9laJE2PNGP5hMH2EwqlmyhQaSGgl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  antivmcredential_accessdefense_evasiondiscoveryxmrigminerpersistence

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Modifies password files for system users/ groups

    Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

    persistencecredential_accessdefense_evasion

  • File and Directory Permissions Modification

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion

  • Indicator Removal: Clear Command History

    Adversaries may remove indicators of compromise from the host to evade detection.

    defense_evasion

  • Deletes itself

  • Executes dropped EXE

  • Flushes firewall rules

    Flushes/ disables firewall rules inside the Linux kernel.

    defense_evasion

  • OS Credential Dumping

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access

  • Writes DNS configuration

    Writes data to DNS resolver config file.

  • Adds a user to the system

  • Reads system routing table

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  behavioral1