General
- Target x
- Size 3.1MB
- Sample260910-pk65bssgpf
- SHA256 aee04196dacd805b71d4191dc91403feb208cdceff108e1e781c0d507fbeb1a1
Score
10/10
Malware Config
Targets
-
- Target x
- Size 3.1MB
- SHA256 aee04196dacd805b71d4191dc91403feb208cdceff108e1e781c0d507fbeb1a1
Score10/10Detects ProcessHider payload
Family: ProcessHider, ProcHider, libprocesshider
ProcessHider aka ProcHider is a userland rootkit-style library that hides selected processes.
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Modifies the dynamic linker configuration file
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
Process hiding tool: XHide
XHide can hide process names and delay detection
Deletes itself
Executes dropped EXE
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
Enumerates running processes
Discovers information about currently running processes on the system
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
Security Software Discovery
Adversaries may attempt to discover installed security software and its configurations.
MITRE ATT&CK Enterprise v16
Defense Evasion
Hijack Execution Flow
1Dynamic Linker Hijacking
1Virtualization/Sandbox Evasion
2System Checks
2