Analysis

  • max time kernel
    22231s
  • max time network
    153s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • resource tags

    arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    23-08-2022 00:27

General

  • Target

    miner-goldcash.sh

  • Size

    385B

  • MD5

    a6ce27365dfe4ec79dc59240de8860be

  • SHA1

    822c20040f7a27b9604b205d7593741490fe96cb

  • SHA256

    22b8949e17458b0472bd1b7ab9e683f28b7ccc3f884e30cc1367e6b2b1192c26

  • SHA512

    68dc463b782f4799388ebe9c4464a74990829aea0b17d2e40590d4f7552c4a7baefb8a89071f0fcdc35a23d0003e47653a15beca870854f4a4e5c983d74e7c54

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/miner-goldcash.sh
    /tmp/miner-goldcash.sh
    1⤵
    • Writes file to tmp directory
    PID:325
    • /tmp/cpuminer-sse2
      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
      2⤵
        PID:329
      • /bin/sleep
        sleep 5
        2⤵
          PID:330
        • /tmp/cpuminer-sse2
          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
          2⤵
            PID:334
          • /bin/sleep
            sleep 5
            2⤵
              PID:335
            • /tmp/cpuminer-sse2
              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
              2⤵
                PID:336
              • /bin/sleep
                sleep 5
                2⤵
                  PID:337
                • /tmp/cpuminer-sse2
                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                  2⤵
                    PID:338
                  • /bin/sleep
                    sleep 5
                    2⤵
                      PID:339
                    • /tmp/cpuminer-sse2
                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                      2⤵
                        PID:340
                      • /bin/sleep
                        sleep 5
                        2⤵
                          PID:341
                        • /tmp/cpuminer-sse2
                          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                          2⤵
                            PID:342
                          • /bin/sleep
                            sleep 5
                            2⤵
                              PID:343
                            • /tmp/cpuminer-sse2
                              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                              2⤵
                                PID:344
                              • /bin/sleep
                                sleep 5
                                2⤵
                                  PID:345
                                • /tmp/cpuminer-sse2
                                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                  2⤵
                                    PID:346
                                  • /bin/sleep
                                    sleep 5
                                    2⤵
                                      PID:347
                                    • /tmp/cpuminer-sse2
                                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                      2⤵
                                        PID:348
                                      • /bin/sleep
                                        sleep 5
                                        2⤵
                                          PID:349
                                        • /tmp/cpuminer-sse2
                                          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                          2⤵
                                            PID:350
                                          • /bin/sleep
                                            sleep 5
                                            2⤵
                                              PID:351
                                            • /tmp/cpuminer-sse2
                                              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                              2⤵
                                                PID:352
                                              • /bin/sleep
                                                sleep 5
                                                2⤵
                                                  PID:353
                                                • /tmp/cpuminer-sse2
                                                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                  2⤵
                                                    PID:354
                                                  • /bin/sleep
                                                    sleep 5
                                                    2⤵
                                                      PID:355
                                                    • /tmp/cpuminer-sse2
                                                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                      2⤵
                                                        PID:356
                                                      • /bin/sleep
                                                        sleep 5
                                                        2⤵
                                                          PID:357
                                                        • /tmp/cpuminer-sse2
                                                          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                          2⤵
                                                            PID:358
                                                          • /bin/sleep
                                                            sleep 5
                                                            2⤵
                                                              PID:359
                                                            • /tmp/cpuminer-sse2
                                                              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                              2⤵
                                                                PID:360
                                                              • /bin/sleep
                                                                sleep 5
                                                                2⤵
                                                                  PID:361
                                                                • /tmp/cpuminer-sse2
                                                                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                  2⤵
                                                                    PID:362
                                                                  • /bin/sleep
                                                                    sleep 5
                                                                    2⤵
                                                                      PID:363
                                                                    • /tmp/cpuminer-sse2
                                                                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                      2⤵
                                                                        PID:364
                                                                      • /bin/sleep
                                                                        sleep 5
                                                                        2⤵
                                                                          PID:365
                                                                        • /tmp/cpuminer-sse2
                                                                          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                          2⤵
                                                                            PID:366
                                                                          • /bin/sleep
                                                                            sleep 5
                                                                            2⤵
                                                                              PID:367
                                                                            • /tmp/cpuminer-sse2
                                                                              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                              2⤵
                                                                                PID:368
                                                                              • /bin/sleep
                                                                                sleep 5
                                                                                2⤵
                                                                                  PID:369
                                                                                • /tmp/cpuminer-sse2
                                                                                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                  2⤵
                                                                                    PID:370
                                                                                  • /bin/sleep
                                                                                    sleep 5
                                                                                    2⤵
                                                                                      PID:371
                                                                                    • /tmp/cpuminer-sse2
                                                                                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                      2⤵
                                                                                        PID:372
                                                                                      • /bin/sleep
                                                                                        sleep 5
                                                                                        2⤵
                                                                                          PID:373
                                                                                        • /tmp/cpuminer-sse2
                                                                                          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                          2⤵
                                                                                            PID:399
                                                                                          • /bin/sleep
                                                                                            sleep 5
                                                                                            2⤵
                                                                                              PID:401
                                                                                            • /tmp/cpuminer-sse2
                                                                                              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                              2⤵
                                                                                                PID:402
                                                                                              • /bin/sleep
                                                                                                sleep 5
                                                                                                2⤵
                                                                                                  PID:403
                                                                                                • /tmp/cpuminer-sse2
                                                                                                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                  2⤵
                                                                                                    PID:425
                                                                                                  • /bin/sleep
                                                                                                    sleep 5
                                                                                                    2⤵
                                                                                                      PID:427
                                                                                                    • /tmp/cpuminer-sse2
                                                                                                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                      2⤵
                                                                                                        PID:451
                                                                                                      • /bin/sleep
                                                                                                        sleep 5
                                                                                                        2⤵
                                                                                                          PID:452
                                                                                                        • /tmp/cpuminer-sse2
                                                                                                          /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                          2⤵
                                                                                                            PID:461
                                                                                                          • /bin/sleep
                                                                                                            sleep 5
                                                                                                            2⤵
                                                                                                              PID:462
                                                                                                            • /tmp/cpuminer-sse2
                                                                                                              /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                              2⤵
                                                                                                                PID:485
                                                                                                              • /bin/sleep
                                                                                                                sleep 5
                                                                                                                2⤵
                                                                                                                  PID:486
                                                                                                                • /tmp/cpuminer-sse2
                                                                                                                  /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                                  2⤵
                                                                                                                    PID:487
                                                                                                                  • /bin/sleep
                                                                                                                    sleep 5
                                                                                                                    2⤵
                                                                                                                      PID:488
                                                                                                                    • /tmp/cpuminer-sse2
                                                                                                                      /tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME
                                                                                                                      2⤵
                                                                                                                        PID:489

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Matrix

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads