General
- Target 0d5608c5c2d71bd1a90e4b792a41baba76b88064a6d26f60b595e19cef3baf16.gz
- Size 4.8MB
- Sample261028-xpwhdsev7t
- SHA256 0d5608c5c2d71bd1a90e4b792a41baba76b88064a6d26f60b595e19cef3baf16
Malware Config
Targets
-
- Target .rsync/a/a
- Size 6KB
- SHA256 c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Loads a kernel module
Loads a Linux kernel module, potentially to achieve persistence
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
Write file to user bin folder
-
- Target .rsync/a/crond
- Size 2.7MB
- SHA256 2ab4da58efa51dadd0787a32b44cf8533d3d3a7bc1788123c112dcb267821030
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/init01
- Size 9KB
- SHA256 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/init02
- Size 3KB
- SHA256 6c1831216e42bd6f907e5f0f07a4c23e9e047dba3ca943fa7fe304d318c2555d
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
- Target .rsync/a/rmkwork
- Size 2KB
- SHA256 efa6d7375136e09ed7e0116f33d63ae34f480ebeaac82bdb1d11190714e6c793
Score7/10-
Deletes system logs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Abuse sudo or cached sudo credentials to execute code.
-
Deletes log files
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/a/run
- Size 110B
- SHA256 dfd76872cf548ffbf59a2a25a72063e7cee35938e63e95b2c647fb723fce5a5a
Score6/10-
Enumerates running processes
Discovers information about currently running processes on the system
-
- Target .rsync/a/stop
- Size 1KB
- SHA256 d9fe141a2f26257a2ac5abb087411027644a7f67ca5c45add380adbc1986421c
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/a
- Size 157B
- SHA256 dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
-
- Target .rsync/b/run
- Size 109KB
- SHA256 fcea054d899e718be63ddfe1107e65d00cca9f32850c5d950df649f44122fbdd
Score6/10-
Removes the immutable protection flag from a file
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
MITRE ATT&CK Enterprise v16
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Indicator Removal
2Clear Linux or Mac System Logs
2Virtualization/Sandbox Evasion
2System Checks
2