Overview

overview

10

Static

static

5

424a5d4dca...b9.elf

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    39s
  • max time network
    33s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    24/04/2026, 01:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    424a5d4dca5fb9506e7a15abc95d9e8b2a8c91fcf340394db86e38342afe7ab9.elf
  • Size 9.2MB
  • Sample260424-b7dveacs21
  • SHA256 424a5d4dca5fb9506e7a15abc95d9e8b2a8c91fcf340394db86e38342afe7ab9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdiscoveryexecutionxmrigminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Executes dropped EXE 2 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 31 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 16 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 4 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/424a5d4dca5fb9506e7a15abc95d9e8b2a8c91fcf340394db86e38342afe7ab9.elf
    /tmp/424a5d4dca5fb9506e7a15abc95d9e8b2a8c91fcf340394db86e38342afe7ab9.elf
    1⤵
    • Executes dropped EXE
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to shm directory
    PID:1496
    • /dev/shm/kworker-main
      /dev/shm/kworker-main
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1503
    • /dev/shm/kworker-run
      /dev/shm/kworker-run --url 127.0.0.1:43661 --user 42qxWtESb9t1jvteBGCJybRiHB2x6fiMmhmosjUxfDsFUMLtJgYheVUaac2dvHrDfwcogpQFbTz4h2GXkB1rxonqUJQnUyz --pass ubuntu1804-amd64-20260126-en-0 --donate-level 0 --cpu-max-threads-hint 50
      2⤵
      • Checks hardware identifiers (DMI)
      • Reads hardware information
      • Checks CPU configuration
      • Reads CPU attributes
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1508
    • /bin/sh
      sh -c "crond || cron"
      2⤵
        PID:1509
        • /usr/sbin/cron
          cron
          3⤵
          • Reads runtime system information
          PID:1510
      • /bin/sh
        sh -c "(crontab -l 2>/dev/null | grep -v 'udev-mesh-node'; echo '*/15 * * * * pgrep -x 'kworker-run' > /dev/null || /dev/shm/.udev-mesh-node') | crontab -"
        2⤵
          PID:1511
          • /bin/grep
            grep -v udev-mesh-node
            3⤵
              PID:1515
            • /usr/bin/crontab
              crontab -
              3⤵
              • Creates/modifies Cron job
              PID:1513
            • /usr/bin/crontab
              crontab -l
              3⤵
                PID:1514

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .t
                • Path /dev/shm/.t
                • Size 1B
                • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                • MD5 SHA1 SHA512
                Submit Download

                .udev-mesh-node
                • Path /dev/shm/.udev-mesh-node
                • Size 9.2MB
                • SHA256 424a5d4dca5fb9506e7a15abc95d9e8b2a8c91fcf340394db86e38342afe7ab9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kworker-run
                • Path /dev/shm/kworker-run
                • Size 2.5MB
                • SHA256 6e08236af6539d6fb654bb7c5cc8634bc2ecc0bf1738733ca2b984feae5bad7c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmp.z9oBQx
                • Path /var/spool/cron/crontabs/tmp.z9oBQx
                • Size 249B
                • SHA256 0f592b60cc2b99f6db354d4ca2119b73a5f395b3ae21e683dfb9f2d6cf4c3336
                • MD5 SHA1 SHA512 TLSH
                Submit Download