Overview

overview

9

Static

static

cpuminer-avx

ubuntu-18.04-amd64

9

cpuminer-avx2

ubuntu-18.04-amd64

9

cpuminer-avx512

ubuntu-18.04-amd64

9

cpuminer-a...a-vaes

ubuntu-18.04-amd64

9

cpuminer-ryzen

ubuntu-18.04-amd64

9

cpuminer-sse2

ubuntu-18.04-amd64

9

cpuminer-sse2amd

ubuntu-18.04-amd64

9

cpuminer-sse42

ubuntu-18.04-amd64

9

cpuminer-sse42-aes

ubuntu-18.04-amd64

9

miner-avia...urx.sh

ubuntu-18.04-amd64

5

miner-avia...urx.sh

debian-9-armhf

5

miner-avia...urx.sh

debian-9-mips

5

miner-avia...urx.sh

debian-9-mipsel

5

miner-bellcoin.sh

ubuntu-18.04-amd64

5

miner-bellcoin.sh

debian-9-armhf

5

miner-bellcoin.sh

debian-9-mips

5

miner-bellcoin.sh

debian-9-mipsel

5

miner-bitweb.sh

ubuntu-18.04-amd64

5

miner-bitweb.sh

debian-9-armhf

5

miner-bitweb.sh

debian-9-mips

5

miner-bitweb.sh

debian-9-mipsel

5

miner-dms.sh

ubuntu-18.04-amd64

5

miner-dms.sh

debian-9-armhf

5

miner-dms.sh

debian-9-mips

5

miner-dms.sh

debian-9-mipsel

5

miner-goldcash.sh

ubuntu-18.04-amd64

5

miner-goldcash.sh

debian-9-armhf

5

miner-goldcash.sh

debian-9-mips

5

miner-goldcash.sh

debian-9-mipsel

5

miner-gxx.sh

ubuntu-18.04-amd64

5

miner-gxx.sh

debian-9-armhf

5

miner-gxx.sh

debian-9-mips

5

Analysis

  • max time kernel
    22231s
  • max time network
    153s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • resource tags

    arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    23-08-2022 00:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    miner-bellcoin.sh

  • Size

    382B

  • MD5

    6ddc74d0b728c2871d0064adeb81c5e0

  • SHA1

    809b8c2433df3f002db5bb83f5a12586f3bcfd41

  • SHA256

    91f47e78b1e0a8ec97c6e3a8c41ec9723d60fc336aa5d963f5d4e505715b1b93

  • SHA512

    87b4280900dc8ab55016f9dad2e03674714343994d357fd6087417885077779f3cac729be6dd26dc0eb744954c4b75ba9acda9014edc7671b214737da374d4b0

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/miner-bellcoin.sh
    /tmp/miner-bellcoin.sh
    1⤵
    • Writes file to tmp directory
    PID:320
    • /tmp/cpuminer-sse2
      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
      2⤵
        PID:324
      • /bin/sleep
        sleep 5
        2⤵
          PID:325
        • /tmp/cpuminer-sse2
          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
          2⤵
            PID:330
          • /bin/sleep
            sleep 5
            2⤵
              PID:331
            • /tmp/cpuminer-sse2
              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
              2⤵
                PID:332
              • /bin/sleep
                sleep 5
                2⤵
                  PID:333
                • /tmp/cpuminer-sse2
                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                  2⤵
                    PID:334
                  • /bin/sleep
                    sleep 5
                    2⤵
                      PID:335
                    • /tmp/cpuminer-sse2
                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                      2⤵
                        PID:336
                      • /bin/sleep
                        sleep 5
                        2⤵
                          PID:337
                        • /tmp/cpuminer-sse2
                          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                          2⤵
                            PID:338
                          • /bin/sleep
                            sleep 5
                            2⤵
                              PID:339
                            • /tmp/cpuminer-sse2
                              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                              2⤵
                                PID:340
                              • /bin/sleep
                                sleep 5
                                2⤵
                                  PID:341
                                • /tmp/cpuminer-sse2
                                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                  2⤵
                                    PID:342
                                  • /bin/sleep
                                    sleep 5
                                    2⤵
                                      PID:343
                                    • /tmp/cpuminer-sse2
                                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                      2⤵
                                        PID:344
                                      • /bin/sleep
                                        sleep 5
                                        2⤵
                                          PID:345
                                        • /tmp/cpuminer-sse2
                                          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                          2⤵
                                            PID:346
                                          • /bin/sleep
                                            sleep 5
                                            2⤵
                                              PID:347
                                            • /tmp/cpuminer-sse2
                                              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                              2⤵
                                                PID:348
                                              • /bin/sleep
                                                sleep 5
                                                2⤵
                                                  PID:349
                                                • /tmp/cpuminer-sse2
                                                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                  2⤵
                                                    PID:350
                                                  • /bin/sleep
                                                    sleep 5
                                                    2⤵
                                                      PID:351
                                                    • /tmp/cpuminer-sse2
                                                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                      2⤵
                                                        PID:352
                                                      • /bin/sleep
                                                        sleep 5
                                                        2⤵
                                                          PID:353
                                                        • /tmp/cpuminer-sse2
                                                          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                          2⤵
                                                            PID:354
                                                          • /bin/sleep
                                                            sleep 5
                                                            2⤵
                                                              PID:355
                                                            • /tmp/cpuminer-sse2
                                                              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                              2⤵
                                                                PID:356
                                                              • /bin/sleep
                                                                sleep 5
                                                                2⤵
                                                                  PID:357
                                                                • /tmp/cpuminer-sse2
                                                                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                  2⤵
                                                                    PID:358
                                                                  • /bin/sleep
                                                                    sleep 5
                                                                    2⤵
                                                                      PID:359
                                                                    • /tmp/cpuminer-sse2
                                                                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                      2⤵
                                                                        PID:360
                                                                      • /bin/sleep
                                                                        sleep 5
                                                                        2⤵
                                                                          PID:361
                                                                        • /tmp/cpuminer-sse2
                                                                          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                          2⤵
                                                                            PID:362
                                                                          • /bin/sleep
                                                                            sleep 5
                                                                            2⤵
                                                                              PID:363
                                                                            • /tmp/cpuminer-sse2
                                                                              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                              2⤵
                                                                                PID:364
                                                                              • /bin/sleep
                                                                                sleep 5
                                                                                2⤵
                                                                                  PID:365
                                                                                • /tmp/cpuminer-sse2
                                                                                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                  2⤵
                                                                                    PID:392
                                                                                  • /bin/sleep
                                                                                    sleep 5
                                                                                    2⤵
                                                                                      PID:393
                                                                                    • /tmp/cpuminer-sse2
                                                                                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                      2⤵
                                                                                        PID:400
                                                                                      • /bin/sleep
                                                                                        sleep 5
                                                                                        2⤵
                                                                                          PID:401
                                                                                        • /tmp/cpuminer-sse2
                                                                                          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                          2⤵
                                                                                            PID:434
                                                                                          • /bin/sleep
                                                                                            sleep 5
                                                                                            2⤵
                                                                                              PID:436
                                                                                            • /tmp/cpuminer-sse2
                                                                                              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                              2⤵
                                                                                                PID:443
                                                                                              • /bin/sleep
                                                                                                sleep 5
                                                                                                2⤵
                                                                                                  PID:444
                                                                                                • /tmp/cpuminer-sse2
                                                                                                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                  2⤵
                                                                                                    PID:458
                                                                                                  • /bin/sleep
                                                                                                    sleep 5
                                                                                                    2⤵
                                                                                                      PID:460
                                                                                                    • /tmp/cpuminer-sse2
                                                                                                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                      2⤵
                                                                                                        PID:477
                                                                                                      • /bin/sleep
                                                                                                        sleep 5
                                                                                                        2⤵
                                                                                                          PID:478
                                                                                                        • /tmp/cpuminer-sse2
                                                                                                          /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                          2⤵
                                                                                                            PID:479
                                                                                                          • /bin/sleep
                                                                                                            sleep 5
                                                                                                            2⤵
                                                                                                              PID:480
                                                                                                            • /tmp/cpuminer-sse2
                                                                                                              /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                              2⤵
                                                                                                                PID:481
                                                                                                              • /bin/sleep
                                                                                                                sleep 5
                                                                                                                2⤵
                                                                                                                  PID:482
                                                                                                                • /tmp/cpuminer-sse2
                                                                                                                  /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                                  2⤵
                                                                                                                    PID:483
                                                                                                                  • /bin/sleep
                                                                                                                    sleep 5
                                                                                                                    2⤵
                                                                                                                      PID:484
                                                                                                                    • /tmp/cpuminer-sse2
                                                                                                                      /tmp/cpuminer-sse2 -a yespower -o stratum+tcps://stratum-eu.rplant.xyz:13342 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                                      2⤵
                                                                                                                        PID:485

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Matrix

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads