xmrig_linux | 546a65849cd54b2ad6f2e7c386d6c50e366dfe3a16b49a032459cd17d7b0d7f2

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
04-04-2024 17:05

Target

bddf710ebd0179c798e69ff1dce2d86d_JaffaCakes118
Size

860KB
MD5

bddf710ebd0179c798e69ff1dce2d86d
SHA1

fb1f4b10a35ab653447f96ef509648faecd05577
SHA256

546a65849cd54b2ad6f2e7c386d6c50e366dfe3a16b49a032459cd17d7b0d7f2
SHA512

1a13c646e7674fad545d1a704ca7205b4c9d4e5e6a09753db7a5fc205335a8f29075d0ce8f3790e319896f0f2e0cf3e0dad6b9b5417591c54edb4c388874a5bd
SSDEEP

12288:e5TmWicbVSeSjxpZJ9VsagtJ7TkMmq0r+1yseLctjZW74P7iz20/Msl5kS9LXm1g:eo1cbVzSPZzpgvMXr+3n+4Cj/35VlN

Score

10^/10

xmrig_linux miner

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/1470-1-0x00007f8dda42a000-0x00007f8dda772250-memory.dmp	xmrig

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/exe	bddf710ebd0179c798e69ff1dce2d86d_JaffaCakes118
File opened for reading	/proc/meminfo	Process not Found

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/.qucfu.pid

/tmp/bddf710ebd0179c798e69ff1dce2d86d_JaffaCakes118
/tmp/bddf710ebd0179c798e69ff1dce2d86d_JaffaCakes118
1⤵
- Reads runtime system information
PID:1470

/tmp/.qucfu.pid

Filesize
4B

MD5
78b9cab19959e4af8ff46156ee460c74

SHA1
7c8d848f32fa1c53815556ee08aa8ee5994c5a51

SHA256
e5ce886c0b0869006dc9a2da28fcd4f1f291f4a90835b75edb74587b66e5acc9

SHA512
adf7e3718491f26a2853ea8e397727be1f0cb8abcae556f9e2acfeab0ccfdef721614361a09c84d9cfbcea9533d1d6a93be3f870611a13d8e0cbf9ca192e2987

Download Submit