General
- Target install.sh
- Size 71KB
- Sample260809-pg1hdaxemc
- SHA256 a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc
Malware Config
Targets
-
- Target install.sh
- Size 71KB
- SHA256 a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Indicator Removal: File Deletion
Adversaries may remove indicators of compromise from the host to evade detection.
-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Defense Evasion
File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Indicator Removal
3Clear Linux or Mac System Logs
2File Deletion
1Virtualization/Sandbox Evasion
1System Checks
1