Loading malware…
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
crby26td.exe is XMRig Miner, a legitimate open-source cryptocurrency miner designed to mine for Monero, and a.json is a file containing configuration information for cryptomining.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
To hide the activity of the malware, it implements an evasion technique that uses library hijacking. This way the information retrieved by system commands is altered in a way that hides resources used by the malware and its components.
Before running the coinminer, it verifies the path /usr/share/dbus-1/bin contains two files: systemd-host (aka the miner) and the other named IBus, the miner’s configuration file.
To hide the activity of the malware, it implements an evasion technique that uses library hijacking. This way the information retrieved by system commands is altered in a way that hides resources used by the malware and its components.
This code can execute commands and scripts against the local operating system, which can in turn download additional malicious code and provide a route for elevation of privilege and persistent remote access.
In several cases we observed, the threat actors abused their access to deploy web shells, Sliver implants and/or crypto miners.
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.