Overview
overview
9Static
static
cpuminer-avx
ubuntu-18.04-amd64
9cpuminer-avx2
ubuntu-18.04-amd64
9cpuminer-avx512
ubuntu-18.04-amd64
9cpuminer-a...a-vaes
ubuntu-18.04-amd64
9cpuminer-ryzen
ubuntu-18.04-amd64
9cpuminer-sse2
ubuntu-18.04-amd64
9cpuminer-sse2amd
ubuntu-18.04-amd64
9cpuminer-sse42
ubuntu-18.04-amd64
9cpuminer-sse42-aes
ubuntu-18.04-amd64
9miner-avia...urx.sh
ubuntu-18.04-amd64
5miner-avia...urx.sh
debian-9-armhf
5miner-avia...urx.sh
debian-9-mips
5miner-avia...urx.sh
debian-9-mipsel
5miner-bellcoin.sh
ubuntu-18.04-amd64
5miner-bellcoin.sh
debian-9-armhf
5miner-bellcoin.sh
debian-9-mips
5miner-bellcoin.sh
debian-9-mipsel
5miner-bitweb.sh
ubuntu-18.04-amd64
5miner-bitweb.sh
debian-9-armhf
5miner-bitweb.sh
debian-9-mips
5miner-bitweb.sh
debian-9-mipsel
5miner-dms.sh
ubuntu-18.04-amd64
5miner-dms.sh
debian-9-armhf
5miner-dms.sh
debian-9-mips
5miner-dms.sh
debian-9-mipsel
5miner-goldcash.sh
ubuntu-18.04-amd64
5miner-goldcash.sh
debian-9-armhf
5miner-goldcash.sh
debian-9-mips
5miner-goldcash.sh
debian-9-mipsel
5miner-gxx.sh
ubuntu-18.04-amd64
5miner-gxx.sh
debian-9-armhf
5miner-gxx.sh
debian-9-mips
5Analysis
-
max time kernel
22231s -
max time network
153s -
platform
linux_mipsel -
resource
debian9-mipsel-en-20211208 -
resource tags
arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
23-08-2022 00:27
Static task
static1
Behavioral task
behavioral1
Sample
cpuminer-avx
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
cpuminer-avx2
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral3
Sample
cpuminer-avx512
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral4
Sample
cpuminer-avx512-sha-vaes
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral5
Sample
cpuminer-ryzen
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral6
Sample
cpuminer-sse2
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral7
Sample
cpuminer-sse2amd
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral8
Sample
cpuminer-sse42
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral9
Sample
cpuminer-sse42-aes
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral10
Sample
miner-avian-minotaurx.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral11
Sample
miner-avian-minotaurx.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral12
Sample
miner-avian-minotaurx.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral13
Sample
miner-avian-minotaurx.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral14
Sample
miner-bellcoin.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral15
Sample
miner-bellcoin.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral16
Sample
miner-bellcoin.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral17
Sample
miner-bellcoin.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral18
Sample
miner-bitweb.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral19
Sample
miner-bitweb.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral20
Sample
miner-bitweb.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral21
Sample
miner-bitweb.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral22
Sample
miner-dms.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral23
Sample
miner-dms.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral24
Sample
miner-dms.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral25
Sample
miner-dms.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral26
Sample
miner-goldcash.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral27
Sample
miner-goldcash.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral28
Sample
miner-goldcash.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral29
Sample
miner-goldcash.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral30
Sample
miner-gxx.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral31
Sample
miner-gxx.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral32
Sample
miner-gxx.sh
Resource
debian9-mipsbe-en-20211208
General
-
Target
miner-goldcash.sh
-
Size
385B
-
MD5
a6ce27365dfe4ec79dc59240de8860be
-
SHA1
822c20040f7a27b9604b205d7593741490fe96cb
-
SHA256
22b8949e17458b0472bd1b7ab9e683f28b7ccc3f884e30cc1367e6b2b1192c26
-
SHA512
68dc463b782f4799388ebe9c4464a74990829aea0b17d2e40590d4f7552c4a7baefb8a89071f0fcdc35a23d0003e47653a15beca870854f4a4e5c983d74e7c54
Malware Config
Signatures
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
miner-goldcash.shdescription ioc process /tmp/miner-goldcash.sh /tmp/miner-goldcash.sh miner-goldcash.sh
Processes
-
/tmp/miner-goldcash.sh/tmp/miner-goldcash.sh1⤵
- Writes file to tmp directory
PID:325 -
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:329
-
/bin/sleepsleep 52⤵PID:330
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:334
-
/bin/sleepsleep 52⤵PID:335
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:336
-
/bin/sleepsleep 52⤵PID:337
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:338
-
/bin/sleepsleep 52⤵PID:339
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:340
-
/bin/sleepsleep 52⤵PID:341
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:342
-
/bin/sleepsleep 52⤵PID:343
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:344
-
/bin/sleepsleep 52⤵PID:345
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:346
-
/bin/sleepsleep 52⤵PID:347
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:348
-
/bin/sleepsleep 52⤵PID:349
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:350
-
/bin/sleepsleep 52⤵PID:351
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:352
-
/bin/sleepsleep 52⤵PID:353
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:354
-
/bin/sleepsleep 52⤵PID:355
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:356
-
/bin/sleepsleep 52⤵PID:357
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:358
-
/bin/sleepsleep 52⤵PID:359
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:360
-
/bin/sleepsleep 52⤵PID:361
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:362
-
/bin/sleepsleep 52⤵PID:363
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:364
-
/bin/sleepsleep 52⤵PID:365
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:366
-
/bin/sleepsleep 52⤵PID:367
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:368
-
/bin/sleepsleep 52⤵PID:369
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:370
-
/bin/sleepsleep 52⤵PID:371
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:372
-
/bin/sleepsleep 52⤵PID:373
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:399
-
/bin/sleepsleep 52⤵PID:401
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:402
-
/bin/sleepsleep 52⤵PID:403
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:425
-
/bin/sleepsleep 52⤵PID:427
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:451
-
/bin/sleepsleep 52⤵PID:452
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:461
-
/bin/sleepsleep 52⤵PID:462
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:485
-
/bin/sleepsleep 52⤵PID:486
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:487
-
/bin/sleepsleep 52⤵PID:488
-
/tmp/cpuminer-sse2/tmp/cpuminer-sse2 -a yescryptr16 -o stratum+tcps://stratum-eu.rplant.xyz:17057 -u WALLET_ADDRESS.WORKER_NAME2⤵PID:489