General
- Target 5a06123c00db023e465e6863b41387bc4dbe3005296790de37d86f14ae38a0e3.gz
- Size 2.8MB
- Sample260818-lb5y5azbpg
- SHA256 5a06123c00db023e465e6863b41387bc4dbe3005296790de37d86f14ae38a0e3
Malware Config
Targets
-
- Target .rsync/a/a
- Size 6KB
- SHA256 c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
Write file to user bin folder
-
- Target .rsync/a/crond
- Size 2.1MB
- SHA256 a01e58ce02a7b7fe9e5368878d30ce576d958069b30e952ff68686e2264b3292
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/init01
- Size 9KB
- SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/init02
- Size 3KB
- SHA256 6c1831216e42bd6f907e5f0f07a4c23e9e047dba3ca943fa7fe304d318c2555d
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
- Target .rsync/a/rmkwork
- Size 2KB
- SHA256 efa6d7375136e09ed7e0116f33d63ae34f480ebeaac82bdb1d11190714e6c793
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/run
- Size 110B
- SHA256 dfd76872cf548ffbf59a2a25a72063e7cee35938e63e95b2c647fb723fce5a5a
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
- Target .rsync/a/stop
- Size 1KB
- SHA256 d9fe141a2f26257a2ac5abb087411027644a7f67ca5c45add380adbc1986421c
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/a
- Size 157B
- SHA256 dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/run
- Size 109KB
- SHA256 5144bdcbafac26bd8f1474087f2133561c8a18edf1936a91f197957500c5f91b
Score6/10-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
MITRE ATT&CK Enterprise v16
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Indicator Removal
2Clear Linux or Mac System Logs
2Virtualization/Sandbox Evasion
2System Checks
2