Manuel Statik Analiz — XMRig CoinMiner ELF | Tehdit: KRITIK
文件 Kimligi
| SHA256 | e55ed4e871eb3ed2d086e8e30876ca9572b48ea54d413b02e62a9e9f0a8c06a |
|---|---|
| 文件 Adi | _up.bin (Linux ELF) |
| 大小 | 5.338.704 byte (5.3MB) |
| String Sayisi | 22.265 |
| Platform | Linux ELF (x86_64) |
Acik Metin Mining Pool -- DOGRULANMIS
KRITIK IOC: Mining pool adresleri acik metin olarak bulundu.
extranonce.su <-- XMR mining pool mining.su <-- XMR mining pool glibc.me <-- Linux ELF kütüphane (sahte pozitif degil, suspicious domain)
Ghostrider Algoritma
ghostrider/rtm -- Ghostrider (Raptoreum) algoritma ghostrider -- Ghostrider Monero mining pool_wallet -- Cuzdan adresi config alani
IOC
| SHA256 | e55ed4e871eb3ed2d086e8e30876ca9572b48ea54d413b02e62a9e9f0a8c06a |
|---|---|
| Mining Pool | extranonce.su |
| Mining Pool | mining.su |
| Algoritma | Ghostrider (XMR/RTM) |
XMRig — 恶意软件档案
XMRig, acik kaynakli Monero (XMR) miner aracinin kotu amacli degistirilmis surumleridir. Linux ELF ve Windows PE olarak dagitilir. Ghostrider, RandomX ve diğer algoritmalari destekler. Mining pool adreslerini cleartext icerir.
恶意软件类型
Coinminer
编程语言
C++
C2协议
TCP
目标系统
Windows/Linux
能力与行为
CPU/GPU Madenciliği
Kripto Para Üretimi
Kaynak Kullanımı
Kalıcılık
Anti-Analiz
Yayılma Mekanizması
IOC列表 (3 个指标)
IOC — XMRig
# DOMAIN
extranonce.su
# DOMAIN
mining.su
# DOMAIN
glibc.me
| 类型 | 值 | 备注 |
|---|---|---|
| domain | extranonce.su | |
| domain | mining.su | |
| domain | glibc.me |
C2服务器 (该家族共有 2 台已记录服务器)
| 地址 | 类型 | 端口 | 协议 | 状态 | 国家 |
|---|---|---|---|---|---|
| mining.su | domain | — | TCP | active | — |
| extranonce.su | domain | — | TCP | inactive | — |
C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。