Overview

overview

10

Static

static

1

install.sh

ubuntu-18.04-amd64

10

install.sh

debian-9-armhf

10

install.sh

debian-9-mips

install.sh

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target
    install.sh
  • Size 100KB
  • Sample260811-dqergseq8w
  • SHA256 cd164a8cba9df2e7ba3be499a5fbe779db668cd54a476990922b99a22f0b1910
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xmrigantivmcredential_accessdefense_evasiondiscoveryexecutionlinuxminerpersistenceprivilege_escalationrootkit

Malware Config

Targets

    • Target
      install.sh
    • Size 100KB
    • SHA256 cd164a8cba9df2e7ba3be499a5fbe779db668cd54a476990922b99a22f0b1910
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationrootkitantivm

    • Family: xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • File and Directory Permissions Modification

      Adversaries may modify file or directory permissions to evade defenses.

      defense_evasion

    • Indicator Removal: File Deletion

      Adversaries may remove indicators of compromise from the host to evade detection.

      defense_evasion

    • Deletes system logs

      Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

      defense_evasion

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • Modifies the /etc/hosts DNS resolution file

      Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

    • Deletes log files

      Deletes log files on the system.

      defense_evasion

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

      discovery

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

      persistenceprivilege_escalation

    • Removes the immutable protection flag from a file

      Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

    • Reads process memory

      Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

      credential_access
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

1
T1072

Persistence

Boot or Logon Autostart Execution

1
T1547

XDG Autostart Entries

1
T1547.013

Create or Modify System Process

1
T1543

Systemd Service

1
T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

XDG Autostart Entries

1
T1547.013

Create or Modify System Process

1
T1543

Systemd Service

1
T1543.002

Defense Evasion

File and Directory Permissions Modification

2
T1222

Linux and Mac File and Directory Permissions Modification

2
T1222.002

Indicator Removal

3
T1070

Clear Linux or Mac System Logs

2
T1070.002

File Deletion

1
T1070.004

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Adversary-in-the-Middle

1
T1557

OS Credential Dumping

1
T1003

Proc Filesystem

1
T1003.007

Discovery

System Information Discovery

2
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Network Connections Discovery

1
T1049

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Software Deployment Tools

1
T1072

Collection

Adversary-in-the-Middle

1
T1557

Command and Control

Exfiltration

Impact

Tasks