General
- Target f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
- Size 3.3MB
- Sample260706-pmq6wse191
- SHA256 f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
Malware Config
Targets
-
- Target f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
- Size 3.3MB
- SHA256 f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
Score10/10-
Detects Sysrv-Hello botnet
-
Family: SysrvHello,Sysrv
Sysrv-Hello is cryptojacking botnet written in C++.
-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Contacts a large (399972) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Deletes itself
-
Executes dropped EXE
-
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Writes file to system bin folder
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Scheduled Task/Job
1Cron
1