xmrig_linux | 5f3e06f187c4088882133251e9ee6a03e8f11c73354af3bd6fd7c010b46e78f0

Analysis

max time kernel
149s
max time network
145s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
29/08/2024, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xmr_linux_amd64
Size

8.7MB
MD5

aff9d4675fdb21bb30e23ab1466b5841
SHA1

bed1388ccca38218fa67ac7670b0e13bf759702e
SHA256

5f3e06f187c4088882133251e9ee6a03e8f11c73354af3bd6fd7c010b46e78f0
SHA512

2ed958de56fa264446d7d85d36c05e693926a6bfeed6d58aeea7aa1d6f595c94b71472c75834c3edc71ffefc4c3fc59a5362e377ee93c651637d77dc20c9ecf0
SSDEEP

98304:6OiwcvRyACNEbruhSGwXUEvNPHbZNcRsR:diNCKbreqv9bZNcRsR

Score

10^/10

xmrig_linux antivm evasion miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-4.dat	family_xmrig
behavioral2/files/fstream-4.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Executes dropped EXE 25 IoCs

ioc	pid	Process
/tmp/xmrig/xmrig-6.21.3/xmrig	1449	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1456	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1463	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1471	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1478	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1485	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1509	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1517	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1524	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1531	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1538	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1545	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1558	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1565	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1572	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1579	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1586	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1593	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1600	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1607	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1614	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1621	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1632	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1639	xmrig
/tmp/xmrig/xmrig-6.21.3/xmrig	1646	xmrig

Checks hardware identifiers (DMI) 1 TTPs 64 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	xmrig

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org
4	api.ipify.org

Reads hardware information 1 TTPs 64 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_name	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_version	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	xmrig
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	xmrig

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/modules	xmr_linux_amd64

Checks CPU configuration 1 TTPs 26 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmr_linux_amd64
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig
File opened for reading	/proc/cpuinfo	xmrig

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/die_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/cluster_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/base_frequency	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/cluster_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/base_frequency	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/online	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/die_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	xmrig
File opened for reading	/sys/devices/system/cpu/possible	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/cluster_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/id	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/die_cpus	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	xmrig
File opened for reading	/sys/devices/system/cpu/cpu0/topology/cluster_cpus	xmrig

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/devices/cpu_atom/cpus	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_latency	xmrig
File opened for reading	/sys/devices/cpu_core/cpus	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/free_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/meminfo	xmrig
File opened for reading	/sys/devices/system/cpu	xmrig
File opened for reading	/sys/devices/cpu_core/cpus	xmrig
File opened for reading	/sys/firmware/dmi/tables/DMI	xmrig
File opened for reading	/sys/devices/cpu_core/cpus	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.cpus	xmrig
File opened for reading	/sys/devices/virtual/dmi/id	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/devices/system/node/node0/meminfo	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/cpumap	xmrig
File opened for reading	/sys/bus/soc/devices	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_bandwidth	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.cpus	xmrig
File opened for reading	/sys/devices/cpu_atom/cpus	xmrig
File opened for reading	/sys/devices/cpu_core/cpus	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/fs/cgroup/unified/cgroup.controllers	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/free_hugepages	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/free_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_bandwidth	xmrig
File opened for reading	/sys/devices/system/node/node0/meminfo	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators	xmrig
File opened for reading	/sys/devices/system/node/node0/access1/initiators	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages	xmrig
File opened for reading	/sys/devices/system/cpu	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_latency	xmrig
File opened for reading	/sys/bus/dax/devices	xmrig
File opened for reading	/sys/devices/cpu_atom/cpus	xmrig
File opened for reading	/sys/fs/cgroup/unified/cgroup.controllers	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	xmrig
File opened for reading	/sys/devices/cpu_core/cpus	xmrig
File opened for reading	/sys/fs/cgroup/cpuset/cpuset.mems	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_bandwidth	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_bandwidth	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_bandwidth	xmrig
File opened for reading	/sys/devices/cpu_atom/cpus	xmrig
File opened for reading	/sys/kernel/mm/hugepages	xmrig
File opened for reading	/sys/devices/virtual/dmi/id	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/kernel/mm/hugepages	xmrig
File opened for reading	/sys/firmware/dmi/tables/DMI	xmrig
File opened for reading	/sys/devices/system/node/node0/access0/initiators	xmrig
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	xmrig
File opened for reading	/sys/devices/system/node/node0/meminfo	xmrig

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1080/stat	xmr_linux_amd64
File opened for reading	/proc/1183/stat	xmr_linux_amd64
File opened for reading	/proc/633/comm	xmr_linux_amd64
File opened for reading	/proc/1035/cmdline	xmr_linux_amd64
File opened for reading	/proc/mounts	xmrig
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/508/stat	xmr_linux_amd64
File opened for reading	/proc/1485/stat	xmr_linux_amd64
File opened for reading	/proc/mounts	xmrig
File opened for reading	/proc/1043/stat	xmr_linux_amd64
File opened for reading	/proc/923/stat	xmr_linux_amd64
File opened for reading	/proc/1043/cmdline	xmr_linux_amd64
File opened for reading	/proc/85/stat	xmr_linux_amd64
File opened for reading	/proc/1344/stat	xmr_linux_amd64
File opened for reading	/proc/478/stat	xmr_linux_amd64
File opened for reading	/proc/520/stat	xmr_linux_amd64
File opened for reading	/proc/927/stat	xmr_linux_amd64
File opened for reading	/proc/3/comm	xmr_linux_amd64
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/397/stat	xmr_linux_amd64
File opened for reading	/proc/605/cmdline	xmr_linux_amd64
File opened for reading	/proc/1443/comm	xmr_linux_amd64
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/1621/comm	xmr_linux_amd64
File opened for reading	/proc/9/cmdline	xmr_linux_amd64
File opened for reading	/proc/1091/stat	xmr_linux_amd64
File opened for reading	/proc/606/cmdline	xmr_linux_amd64
File opened for reading	/proc/1350/comm	xmr_linux_amd64
File opened for reading	/proc/self/cpuset	xmrig
File opened for reading	/proc/14/stat	xmr_linux_amd64
File opened for reading	/proc/76/comm	xmr_linux_amd64
File opened for reading	/proc/76/cmdline	xmr_linux_amd64
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/72/stat	xmr_linux_amd64
File opened for reading	/proc/1402/comm	xmr_linux_amd64
File opened for reading	/proc/1485/comm	xmr_linux_amd64
File opened for reading	/proc/sys/vm/nr_hugepages	xmrig
File opened for reading	/proc/1117/comm	xmr_linux_amd64
File opened for reading	/proc/8/cmdline	xmr_linux_amd64
File opened for reading	/proc/1091/cmdline	xmr_linux_amd64
File opened for reading	/proc/583/stat	xmr_linux_amd64
File opened for reading	/proc/477/comm	xmr_linux_amd64
File opened for reading	/proc/502/comm	xmr_linux_amd64
File opened for reading	/proc/930/comm	xmr_linux_amd64
File opened for reading	/proc/942/comm	xmr_linux_amd64
File opened for reading	/proc/mounts	xmrig
File opened for reading	/proc/12/stat	xmr_linux_amd64
File opened for reading	/proc/477/cmdline	xmr_linux_amd64
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/cpuset	xmrig
File opened for reading	/proc/cmdline	xmrig
File opened for reading	/proc/1354/stat	xmr_linux_amd64
File opened for reading	/proc/sys/vm/nr_hugepages	xmrig
File opened for reading	/proc/22/comm	xmr_linux_amd64
File opened for reading	/proc/663/comm	xmr_linux_amd64
File opened for reading	/proc/1352/stat	xmr_linux_amd64
File opened for reading	/proc/1088/stat	xmr_linux_amd64
File opened for reading	/proc/81/comm	xmr_linux_amd64
File opened for reading	/proc/922/cmdline	xmr_linux_amd64
File opened for reading	/proc/meminfo	xmrig
File opened for reading	/proc/1620/comm	xmr_linux_amd64
File opened for reading	/proc/1076/stat	xmr_linux_amd64

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig/xmrig-6.21.3/SHA256SUMS	xmr_linux_amd64
File opened for modification	/tmp/xmrig/xmrig-6.21.3/xmrig	xmr_linux_amd64
File opened for modification	/tmp/xmrig/xmrig.tar.gz	xmr_linux_amd64
File opened for modification	/tmp/xmrig/xmrig-6.21.3/config.json	xmr_linux_amd64

/tmp/xmr_linux_amd64
/tmp/xmr_linux_amd64
1⤵
- Reads list of loaded kernel modules
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1403
- /usr/bin/sudo
  sudo -n true
  2⤵
  - Reads runtime system information
  PID:1446
- - /usr/bin/true
    true
    3⤵
    PID:1447
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1448
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Enumerates kernel/hardware configuration
    PID:1449
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1455
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1456
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1462
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1463
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1470
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1471
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1477
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1478
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1484
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1485
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1508
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1509
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1516
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1517
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1523
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1524
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1530
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1531
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1537
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1538
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1544
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1545
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1557
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Reads runtime system information
    PID:1558
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1564
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1565
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1571
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1572
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1578
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1579
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1585
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1586
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1592
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1593
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1599
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1600
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1606
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Reads runtime system information
    PID:1607
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1613
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1614
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  - Reads runtime system information
  PID:1620
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1621
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1631
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1632
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1638
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1639
- /usr/bin/sudo
  sudo -n /tmp/xmrig/xmrig-6.21.3/xmrig
  2⤵
  PID:1645
- - /tmp/xmrig/xmrig-6.21.3/xmrig
    /tmp/xmrig/xmrig-6.21.3/xmrig
    3⤵
    - Executes dropped EXE
    - Checks hardware identifiers (DMI)
    - Reads hardware information
    - Checks CPU configuration
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:1646

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig/xmrig-6.21.3/SHA256SUMS

Filesize
150B

MD5
4f3be397a97fe6981754daeff1c2b77b

SHA1
251612464045242636103e61da4a0bc02c8fb99b

SHA256
1410925f0ec5a63a042402fd06a1037c06530aefa065aa80a242d82b580c571c

SHA512
a22c03e97750a3bd02021514fd12475f502934d94f6b7cf44a2d0a3469618864f8e31df09e84db5f1f1e1be277492922528c614a67dc766754ca4f2e003c880a

Download Submit
/tmp/xmrig/xmrig-6.21.3/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig/xmrig-6.21.3/config.json

Filesize
3KB

MD5
2c63dc93a2c74d2a6f6ead20ffa50cdb

SHA1
e7a54d662d30702518f88860c88c6a7e55d200be

SHA256
d094b093b5d5a1b833828ef566318915be92bf95e03dd36b25eb6832e6b5099d

SHA512
dc8f70e77818e7248fa1d251d8d67c0a52af9ca372cb480b58c228855aa0413c0e6a8170622725f2745d90e780e71a5f7b9b3c4a68997a92fdef85153d863d4b

Download Submit
/tmp/xmrig/xmrig-6.21.3/config.json

Filesize
3KB

MD5
84d276796275c110d420a07e94a961ce

SHA1
6f129e56eacbee5d2458084f214dbd0cf9edbbfd

SHA256
285b187e0572703a6970cbf9842d3b15a16308944a6ca34c25b3e5e09a33c542

SHA512
a3ee33afcc82e57f27b82cb5d7050af71a194abeff6d0f4976b1723309106e9c02a88818b84212f1f09c6886c37e5de73413fde1d4511c6d36ac990aa715b1c8

Download Submit
/tmp/xmrig/xmrig-6.21.3/xmrig

Filesize
7.9MB

MD5
7429d24207b100f6c164bf4703b5941e

SHA1
a7fad4de1ce0ed2c137c09d4bf9fe7276555f4a0

SHA256
72ac2877c9e4cd7d70673c0643eb16805977a9b8d55b6b2e5a6491db565cee1f

SHA512
7d9bcb836d154f5f143815749c36dc928036fb718f4242062a70aa921cbffdd763e167552c79070df1ad8ae7c02647892bcfaa859e24137c3cd41a7f6f6cae27

Download Submit
/tmp/xmrig/xmrig.tar.gz

Filesize
3.3MB

MD5
06b8367fc7b84a666a561a6915a4501d

SHA1
d06991f03408390059df8fc387ac7923e4b5fb7a

SHA256
a0eefd7a5c0efd1cac153a075b4fdead443a04f11cc587a09bd5ac09e174f10f

SHA512
8d507bc49cebf932b7f248c5aea83977352e8e88e02cdbb6cc57d040c0e754ab514106156d42a0ada5d3d4dd549cd6272ec9aca966127430b51680926f98e204

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads