Overview

overview

10

Static

static

7

-bash-55bb...859237

ubuntu-20.04-amd64

10

-bash-55bb...859237

ubuntu-22.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    -bash-55bb90b9-2429-4214-8c22-5d8ee0859237

  • Size

    2.3MB

  • Sample

    240703-dn1k6syeln

  • MD5

    b9f096559e923787ebb1288c93ce2902

  • SHA1

    94851bcc8f9c651bcda0ff33d17356cb0b16cf12

  • SHA256

    1fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5

  • SHA512

    ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be

  • SSDEEP

    49152:hjYpLCWvHFiMBiBFjrhrlzr18t7LxcAk4u7prrRQx:MvlNiPt9y7LxXk5prrA

Score
10/10
xmrigantivmlinuxminerpersistenceupx

Malware Config

Targets

    • Target

      -bash-55bb90b9-2429-4214-8c22-5d8ee0859237

    • Size

      2.3MB

    • MD5

      b9f096559e923787ebb1288c93ce2902

    • SHA1

      94851bcc8f9c651bcda0ff33d17356cb0b16cf12

    • SHA256

      1fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5

    • SHA512

      ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be

    • SSDEEP

      49152:hjYpLCWvHFiMBiBFjrhrlzr18t7LxcAk4u7prrRQx:MvlNiPt9y7LxXk5prrA

    Score
    10/10
    xmrigantivmminerpersistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

      persistence

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks