xmrig | hxxps://docs[.]google[.]com/document/d/13MAECA6lonS27vePOxmRckasWg4Ce2RPph4TLjQcZhY/edit?tab=t[.]0

- Target
  https://docs.google.com/document/d/13MAECA6lonS27vePOxmRckasWg4Ce2RPph4TLjQcZhY/edit?tab=t.0
Score

10^/10

antivm discovery xmrig miner xmrig_linux
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Family: xmrig

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Checks hardware identifiers (DMI)

Contacts third-party web service commonly abused for C2

Reads hardware information

MITRE ATT&CK Enterprise v16

Tasks

static1

urlscan1

behavioral1

behavioral2

behavioral3