Overview

overview

9

Static

static

cpuminer-avx

ubuntu-18.04-amd64

9

cpuminer-avx2

ubuntu-18.04-amd64

9

cpuminer-avx512

ubuntu-18.04-amd64

9

cpuminer-a...a-vaes

ubuntu-18.04-amd64

9

cpuminer-ryzen

ubuntu-18.04-amd64

9

cpuminer-sse2

ubuntu-18.04-amd64

9

cpuminer-sse2amd

ubuntu-18.04-amd64

9

cpuminer-sse42

ubuntu-18.04-amd64

9

cpuminer-sse42-aes

ubuntu-18.04-amd64

9

miner-avia...urx.sh

ubuntu-18.04-amd64

5

miner-avia...urx.sh

debian-9-armhf

5

miner-avia...urx.sh

debian-9-mips

5

miner-avia...urx.sh

debian-9-mipsel

5

miner-bellcoin.sh

ubuntu-18.04-amd64

5

miner-bellcoin.sh

debian-9-armhf

5

miner-bellcoin.sh

debian-9-mips

5

miner-bellcoin.sh

debian-9-mipsel

5

miner-bitweb.sh

ubuntu-18.04-amd64

5

miner-bitweb.sh

debian-9-armhf

5

miner-bitweb.sh

debian-9-mips

5

miner-bitweb.sh

debian-9-mipsel

5

miner-dms.sh

ubuntu-18.04-amd64

5

miner-dms.sh

debian-9-armhf

5

miner-dms.sh

debian-9-mips

5

miner-dms.sh

debian-9-mipsel

5

miner-goldcash.sh

ubuntu-18.04-amd64

5

miner-goldcash.sh

debian-9-armhf

5

miner-goldcash.sh

debian-9-mips

5

miner-goldcash.sh

debian-9-mipsel

5

miner-gxx.sh

ubuntu-18.04-amd64

5

miner-gxx.sh

debian-9-armhf

5

miner-gxx.sh

debian-9-mips

5

Analysis

  • max time kernel
    22232s
  • max time network
    158s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    23-08-2022 00:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    miner-dms.sh

  • Size

    378B

  • MD5

    8c1768f93cf5a039a0c34e1136068623

  • SHA1

    6cb2ef7774d919f55a0eb8171ac26c46f9a434a8

  • SHA256

    d6fec69fb25240c83b67df1930a35a38d8581b633eee609c1adc29bea5b37eb9

  • SHA512

    9dc0e3e6f0751ef79726bad79b503831f1798f951f6970c36e373e20f37488fef48eb19447dd618a80f119761877bb50313de0914649f7d97b8b11b2fb32a36a

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/miner-dms.sh
    /tmp/miner-dms.sh
    1⤵
    • Writes file to tmp directory
    PID:359
    • /tmp/cpuminer-sse2
      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
      2⤵
        PID:365
      • /bin/sleep
        sleep 5
        2⤵
          PID:366
        • /tmp/cpuminer-sse2
          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
          2⤵
            PID:371
          • /bin/sleep
            sleep 5
            2⤵
              PID:372
            • /tmp/cpuminer-sse2
              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
              2⤵
                PID:375
              • /bin/sleep
                sleep 5
                2⤵
                  PID:376
                • /tmp/cpuminer-sse2
                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                  2⤵
                    PID:377
                  • /bin/sleep
                    sleep 5
                    2⤵
                      PID:378
                    • /tmp/cpuminer-sse2
                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                      2⤵
                        PID:381
                      • /bin/sleep
                        sleep 5
                        2⤵
                          PID:382
                        • /tmp/cpuminer-sse2
                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                          2⤵
                            PID:383
                          • /bin/sleep
                            sleep 5
                            2⤵
                              PID:384
                            • /tmp/cpuminer-sse2
                              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                              2⤵
                                PID:386
                              • /bin/sleep
                                sleep 5
                                2⤵
                                  PID:387
                                • /tmp/cpuminer-sse2
                                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                  2⤵
                                    PID:389
                                  • /bin/sleep
                                    sleep 5
                                    2⤵
                                      PID:390
                                    • /tmp/cpuminer-sse2
                                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                      2⤵
                                        PID:391
                                      • /bin/sleep
                                        sleep 5
                                        2⤵
                                          PID:392
                                        • /tmp/cpuminer-sse2
                                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                          2⤵
                                            PID:395
                                          • /bin/sleep
                                            sleep 5
                                            2⤵
                                              PID:396
                                            • /tmp/cpuminer-sse2
                                              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                              2⤵
                                                PID:397
                                              • /bin/sleep
                                                sleep 5
                                                2⤵
                                                  PID:398
                                                • /tmp/cpuminer-sse2
                                                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                  2⤵
                                                    PID:401
                                                  • /bin/sleep
                                                    sleep 5
                                                    2⤵
                                                      PID:402
                                                    • /tmp/cpuminer-sse2
                                                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                      2⤵
                                                        PID:403
                                                      • /bin/sleep
                                                        sleep 5
                                                        2⤵
                                                          PID:404
                                                        • /tmp/cpuminer-sse2
                                                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                          2⤵
                                                            PID:407
                                                          • /bin/sleep
                                                            sleep 5
                                                            2⤵
                                                              PID:408
                                                            • /tmp/cpuminer-sse2
                                                              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                              2⤵
                                                                PID:409
                                                              • /bin/sleep
                                                                sleep 5
                                                                2⤵
                                                                  PID:410
                                                                • /tmp/cpuminer-sse2
                                                                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                  2⤵
                                                                    PID:413
                                                                  • /bin/sleep
                                                                    sleep 5
                                                                    2⤵
                                                                      PID:414
                                                                    • /tmp/cpuminer-sse2
                                                                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                      2⤵
                                                                        PID:415
                                                                      • /bin/sleep
                                                                        sleep 5
                                                                        2⤵
                                                                          PID:416
                                                                        • /tmp/cpuminer-sse2
                                                                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                          2⤵
                                                                            PID:419
                                                                          • /bin/sleep
                                                                            sleep 5
                                                                            2⤵
                                                                              PID:420
                                                                            • /tmp/cpuminer-sse2
                                                                              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                              2⤵
                                                                                PID:421
                                                                              • /bin/sleep
                                                                                sleep 5
                                                                                2⤵
                                                                                  PID:422
                                                                                • /tmp/cpuminer-sse2
                                                                                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                  2⤵
                                                                                    PID:425
                                                                                  • /bin/sleep
                                                                                    sleep 5
                                                                                    2⤵
                                                                                      PID:426
                                                                                    • /tmp/cpuminer-sse2
                                                                                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                      2⤵
                                                                                        PID:453
                                                                                      • /bin/sleep
                                                                                        sleep 5
                                                                                        2⤵
                                                                                          PID:454
                                                                                        • /tmp/cpuminer-sse2
                                                                                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                          2⤵
                                                                                            PID:483
                                                                                          • /bin/sleep
                                                                                            sleep 5
                                                                                            2⤵
                                                                                              PID:484
                                                                                            • /tmp/cpuminer-sse2
                                                                                              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                              2⤵
                                                                                                PID:506
                                                                                              • /bin/sleep
                                                                                                sleep 5
                                                                                                2⤵
                                                                                                  PID:507
                                                                                                • /tmp/cpuminer-sse2
                                                                                                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                  2⤵
                                                                                                    PID:536
                                                                                                  • /bin/sleep
                                                                                                    sleep 5
                                                                                                    2⤵
                                                                                                      PID:537
                                                                                                    • /tmp/cpuminer-sse2
                                                                                                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                      2⤵
                                                                                                        PID:540
                                                                                                      • /bin/sleep
                                                                                                        sleep 5
                                                                                                        2⤵
                                                                                                          PID:541
                                                                                                        • /tmp/cpuminer-sse2
                                                                                                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                          2⤵
                                                                                                            PID:542
                                                                                                          • /bin/sleep
                                                                                                            sleep 5
                                                                                                            2⤵
                                                                                                              PID:543
                                                                                                            • /tmp/cpuminer-sse2
                                                                                                              /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                              2⤵
                                                                                                                PID:546
                                                                                                              • /bin/sleep
                                                                                                                sleep 5
                                                                                                                2⤵
                                                                                                                  PID:547
                                                                                                                • /tmp/cpuminer-sse2
                                                                                                                  /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                                  2⤵
                                                                                                                    PID:548
                                                                                                                  • /bin/sleep
                                                                                                                    sleep 5
                                                                                                                    2⤵
                                                                                                                      PID:549
                                                                                                                    • /tmp/cpuminer-sse2
                                                                                                                      /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                                      2⤵
                                                                                                                        PID:552
                                                                                                                      • /bin/sleep
                                                                                                                        sleep 5
                                                                                                                        2⤵
                                                                                                                          PID:553
                                                                                                                        • /tmp/cpuminer-sse2
                                                                                                                          /tmp/cpuminer-sse2 -a yescryptr32 -o stratum+tcps://stratum-eu.rplant.xyz:17047 -u WALLET.WORKER_NAME
                                                                                                                          2⤵
                                                                                                                            PID:554

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Matrix

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads