xmrig_linux | 8ec3c00f82b3daf2b8555a439e59ec960f0343d3d4c9c2b20bc9e0878b71939e

Sharing

Copy URL Twitter E-mail

General

Target
8ec3c00f82b3daf2b8555a439e59ec960f0343d3d4c9c2b20bc9e0878b71939e
Size 664KB
Sample260712-sx1d4aet2x
SHA256 8ec3c00f82b3daf2b8555a439e59ec960f0343d3d4c9c2b20bc9e0878b71939e
MD5 290ded435d076b28dfa2c9069ede64eb
SHA1 5086c8403064fd5bff3c9fe6076f02fa437ad609
SHA512 2deecb0632d6391f3aacb520e38c7e2ae8cd6363997a0dbf1fe2b92e15e4155518e90602ffe162996330637a153547417f7c9990e47259605a40db574867d9a7
SSDEEP 12288:yR7o/CAJwZGBQ5CqOBHaZBw5VD1OgyKC2vbQl+b4IE+Bo2rtStuSG9:ypo/CeHSUqO9KByVJRNj6+bjE+B+I9
TLSH
T18AE423C8DDF94723A6E9F01AFB2E866165E216E164BB079573A39FF3B42D0C90160471
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  .rsync/a/a
- Size 6KB
- SHA256 c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
- MD5 69c7923ed59fb2c2b98952e2388c152b
- SHA1 4d99ac7f50852ddfcb725330c2f2411d800be149
- SHA512 41dedaf997c6a3a91b5db5bcbaded52fce41491585d470313ab54eb72c1d61d8e30a5fd4634f8764c9be026206f16ed4b6ce0de8cd26c9fd307f7d5f4499f594
- SSDEEP 192:gfgH9BeKLOOuK/0HiBeKLOOuKvAV9HdnIllo:gfgDeg9ue0Seg9u8A7
- TLSH
  T13DD1FA0AF35857BBAD1D58E43CCB7D326C277696E4B10CE519C68781C8ECA4D78B021E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

antivm defense_evasion discovery xmrig_linux miner persistence rootkit
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Write file to user bin folder
  persistence
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  .rsync/a/crond
- Size 628KB
- SHA256 f700a8d6b5f5649af49460ad8c64e4ec2c862a27403cdcca1bfbc84d2324bea6
- MD5 79706d865adbc98302a22013a7b64cb2
- SHA1 cd2899d2e0f5bfa511aed1819368466101a8efeb
- SHA512 04a7a62d27ea0123f82e34b33ddccbed5b16afb957fd7d7d741f2f9dfa9c60818094f381f92086db0bf9c42eebd8c14dcaa72dcb477af55d10c98e4c5fa65374
- SSDEEP 12288:zjpydq/woitVIq0lYGBocEmrarKMeeDT1tFP9tX9DonotZv4csz:nt/woif0l8cEvK/eVb9nkotZv4c+
- TLSH
  T150D4230552413978F78DBF7AE2B8905B10DB4B592ACFBCB58B2946AED2442FC4CC8C53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  .rsync/a/init01
- Size 9KB
- SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
- MD5 e8ffc6aac5c2784b10319c25d229a44e
- SHA1 0bcdd833c497eebc1cbe003a091142a19f2cbf0c
- SHA512 197104ba26107fa8f235e708901a74d9220701721fbff0cac13306b6f1bf50ae0e947846239ec6053ca835d6ee6b0bda1ede6f69ac26f36d8af47d0579bf52f1
- SSDEEP 96:97gXuXmR7PofQH8h9GVQbxgeJwI2n2lznGWSKKFZ5W:97xmRbok8hAGbxPz900
- TLSH
  T1FB123A5F5577FCB9BB52D8A3D961672958E9D1898EF33998220EFB787080040F7340AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral6 behavioral7 behavioral8 behavioral9
- Target
  .rsync/a/run
- Size 110B
- SHA256 dfd76872cf548ffbf59a2a25a72063e7cee35938e63e95b2c647fb723fce5a5a
- MD5 f66f37be202765de93d7b5964bebeba7
- SHA1 bc5fe4a0d3fa7f7e50cfe6f3824c7fa5c2de3de7
- SHA512 56b2159daac0a3110240ffa52a2e30b6fe4caf38fcdc0c829d7da87b97e885d7d91fe31894eb12009e354d501ec13ea32df8478759dcd58b9ab54c613babdf84
- TLSH
  T1AFB0129618313C09B90C53EBFBC7AC3D40430E228E1DF442C29E1A79D18D34B1C1C24E
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral10 behavioral11 behavioral12 behavioral13
- Target
  .rsync/a/stop
- Size 1KB
- SHA256 d9fe141a2f26257a2ac5abb087411027644a7f67ca5c45add380adbc1986421c
- MD5 559e5642c1472cb66f11ab9a1eb56b7f
- SHA1 9c891d7100889580a115649a7f825b1683b54b13
- SHA512 3f60c7e53f4e3053629455195adf8240cb6984b8620651cf3a04c37e8f63926c7f11a3b9bf065b9d8a280252285501e694bd055ee3f93fd0b59451e64f9c6635
- TLSH
  T14521F51D7136DE771427D628DB60862586FEC0AD9DB73F08A110FAB4B24514EEE3149E
- MD5 SHA1 SHA512 TLSH
Score

10^/10

discovery xmrig_linux miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig_linux
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral14 behavioral15 behavioral16 behavioral17
- Target
  .rsync/b/a
- Size 157B
- SHA256 dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
- MD5 17dfec62acb9bc298bb333fbe391f486
- SHA1 960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795
- SHA512 21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881
- TLSH
  T1CDC08CCC06F83308AEC8E662F50332F802C18A0CA80A9C03748A1AB2C2D43E238143C0
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral18 behavioral19 behavioral20 behavioral21
- Target
  .rsync/b/run
- Size 109KB
- SHA256 5144bdcbafac26bd8f1474087f2133561c8a18edf1936a91f197957500c5f91b
- MD5 2099d3f33e42196b17eb11daf51723e9
- SHA1 1770e41bd97ffa616cb07a3d9fe00c93550fc2a0
- SHA512 12cabb7dd612a08a8d6fb56c6fe719769af284dfdfbdd8c51d44db95a283a0e03f9c6b9640c6fa3be9f6bda3798903db3431d4d51cb5bbc6e8a3cdd54fe67a13
- SSDEEP 1536:rG6dkLpUqE3VuQz7kG6dkLpUqE3VuQz78fbpT8PqfZOHV2lp:rXdkOeXdkOUZd
- TLSH
  T144B3F82AEE8F1D4A8BD16C021BCE09E569CC07899CD45DDF100FE6D85E6F03918EC6E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Attempts to change immutable files
  Modifies inode attributes on the filesystem to allow changing of immutable files.
behavioral22 behavioral23 behavioral24 behavioral25
- Target
  .rsync/b/stop
- Size 1KB
- SHA256 593ea276e442f1df193419307b24bdc11b050d34fe465db33289b79fd9e50ca8
- MD5 b010ac9859f9344e6300665418a17dfd
- SHA1 fcccfa7280f4f496b18b6332d1b8bba52c973e9f
- SHA512 3f58f006f3b4f4f09bc421a6e91da671a1ddd06ef5fc8ee6162c43e1836f591f569f559ca6de5068791c4177fb55d8338629cafe1a58528963680f2bdd453b2b
- TLSH
  T109214F0C6173FF7B5923EE72D661472585ABD48A88F73F1C1102BAB8B184009F73149E
- MD5 SHA1 SHA512 TLSH
Score

6^/10

discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral26 behavioral27 behavioral28 behavioral29

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

File and Directory Permissions Modification

Executes dropped EXE

Loads a kernel module

Attempts to change immutable files

Enumerates running processes

Write file to user bin folder

Attempts to change immutable files

Enumerates running processes

Enumerates running processes

Family: xmrig

Attempts to change immutable files

Enumerates running processes

File and Directory Permissions Modification

Attempts to change immutable files

Enumerates running processes

Attempts to change immutable files

Enumerates running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29