General
- Target 6b887a92cbaf75683ae17a1bcf3200a1fec38ba585b7f99403c7744f13a304f2.gz
- Size 540KB
- Sample260819-vbxr7agc55
- SHA256 6b887a92cbaf75683ae17a1bcf3200a1fec38ba585b7f99403c7744f13a304f2
Malware Config
Targets
-
- Target .rsync/a/a
- Size 6KB
- SHA256 c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
Write file to user bin folder
-
- Target .rsync/a/crond
- Size 504KB
- SHA256 b907430e28d008ebbc472334307bfc7e1a3e7233d510671785a620051834a548
Score1/10 -
- Target .rsync/a/init01
- Size 9KB
- SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/run
- Size 110B
- SHA256 dfd76872cf548ffbf59a2a25a72063e7cee35938e63e95b2c647fb723fce5a5a
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
- Target .rsync/a/stop
- Size 1KB
- SHA256 d9fe141a2f26257a2ac5abb087411027644a7f67ca5c45add380adbc1986421c
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/a
- Size 157B
- SHA256 dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/run
- Size 109KB
- SHA256 5144bdcbafac26bd8f1474087f2133561c8a18edf1936a91f197957500c5f91b
Score6/10-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/stop
- Size 1KB
- SHA256 593ea276e442f1df193419307b24bdc11b050d34fe465db33289b79fd9e50ca8
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Virtualization/Sandbox Evasion
1System Checks
1