General
- Target f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
- Size 3.3MB
- Sample260706-pmq6wse191
- SHA256 f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
Malware Config
Targets
-
- Target f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
- Size 3.3MB
- SHA256 f2542c584c4236a5135e4048f53fabca349d9f1b8d49a194974631e6b79e0795
Score10/10Detects Sysrv-Hello botnet
Family: SysrvHello,Sysrv
Sysrv-Hello is cryptojacking botnet written in C++.
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Contacts a large (399972) amount of remote hosts
This may indicate a network scan to discover remotely running services.
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
Deletes itself
Executes dropped EXE
Attempts to change immutable files
Modifies inode attributes on the filesystem to allow changing of immutable files.
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
Enumerates running processes
Discovers information about currently running processes on the system
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
Writes file to system bin folder
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Scheduled Task/Job
1Cron
1