General
- Target install.sh
- Size 90KB
- Sample260810-rtcyysbk7v
- SHA256 78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8
Malware Config
Targets
-
- Target install.sh
- Size 90KB
- SHA256 78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Indicator Removal: File Deletion
Adversaries may remove indicators of compromise from the host to evade detection.
-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Defense Evasion
File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Indicator Removal
3Clear Linux or Mac System Logs
2File Deletion
1Virtualization/Sandbox Evasion
1System Checks
1