Analysis
- max time kernel
149s - max time network
152s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
25/05/2026, 10:52
Behavioral task
behavioral1
Sample
bluefix.armv7.elf
Resource
debian12-armhf-20260127-en
debian-12-armhf
8 signatures
150 seconds
General
- Target bluefix.armv7.elf
- Size 2.4MB
- Sample260525-mykr5shs21
- SHA256 e0bbf8208a9cb5d5c21f9118ca4395d2a9e1004a12a169125f06e6818aa9f88c
- MD5 409ebd11fe97304938b6593ac4c30c89
- SHA1 25c611a6acc0e478959d94dfaf996d8b5bdfeda4
- SHA512 4dcccf334f7cd0daa92436eaa2feb994c4f0723125b883e2a3094a146253e4e6fc9595091bcae50ec82c33cfa79dcec7267e164cca302f503c122dba2adfaadb
- SSDEEP 49152:5YkzHg3hPXmXKIqQCo+yozywKMrkPPKiGxwZ:5pHKIqQ7bwKfnt0wZ
- TLSH T10FC5E09EE3533C45C4FEBA7B908AC5401AD38C5738F385853E02593B75BE9216F61BA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself libuv-worker 826 bluefix.armv7.elf Changes the process name, possibly in an attempt to hide itself libuv-worker 827 bluefix.armv7.elf Changes the process name, possibly in an attempt to hide itself libuv-worker 828 bluefix.armv7.elf Changes the process name, possibly in an attempt to hide itself libuv-worker 829 bluefix.armv7.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo bluefix.armv7.elf - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online bluefix.armv7.elf - Enumerates kernel/hardware configuration 1 TTPs 5 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages bluefix.armv7.elf File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/free_hugepages bluefix.armv7.elf File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages bluefix.armv7.elf File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages bluefix.armv7.elf File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages bluefix.armv7.elf -
description ioc Process File opened for reading /proc/8/stat bluefix.armv7.elf File opened for reading /proc/29/stat bluefix.armv7.elf File opened for reading /proc/317/stat bluefix.armv7.elf File opened for reading /proc/15/stat bluefix.armv7.elf File opened for reading /proc/28/stat bluefix.armv7.elf File opened for reading /proc/36/stat bluefix.armv7.elf File opened for reading /proc/42/stat bluefix.armv7.elf File opened for reading /proc/220/stat bluefix.armv7.elf File opened for reading /proc/676/stat bluefix.armv7.elf File opened for reading /proc/804/stat bluefix.armv7.elf File opened for reading /proc/198/stat bluefix.armv7.elf File opened for reading /proc/4/stat bluefix.armv7.elf File opened for reading /proc/9/stat bluefix.armv7.elf File opened for reading /proc/10/stat bluefix.armv7.elf File opened for reading /proc/16/stat bluefix.armv7.elf File opened for reading /proc/19/stat bluefix.armv7.elf File opened for reading /proc/20/stat bluefix.armv7.elf File opened for reading /proc/334/stat bluefix.armv7.elf File opened for reading /proc/uptime bluefix.armv7.elf File opened for reading /proc/11/stat bluefix.armv7.elf File opened for reading /proc/17/stat bluefix.armv7.elf File opened for reading /proc/30/stat bluefix.armv7.elf File opened for reading /proc/671/stat bluefix.armv7.elf File opened for reading /proc/2/stat bluefix.armv7.elf File opened for reading /proc/5/stat bluefix.armv7.elf File opened for reading /proc/18/stat bluefix.armv7.elf File opened for reading /proc/641/stat bluefix.armv7.elf File opened for reading /proc/22/stat bluefix.armv7.elf File opened for reading /proc/57/stat bluefix.armv7.elf File opened for reading /proc/73/stat bluefix.armv7.elf File opened for reading /proc/142/stat bluefix.armv7.elf File opened for reading /proc/32/stat bluefix.armv7.elf File opened for reading /proc/45/stat bluefix.armv7.elf File opened for reading /proc/143/stat bluefix.armv7.elf File opened for reading /proc/353/stat bluefix.armv7.elf File opened for reading /proc/358/stat bluefix.armv7.elf File opened for reading /proc/734/stat bluefix.armv7.elf File opened for reading /proc/1/stat bluefix.armv7.elf File opened for reading /proc/14/stat bluefix.armv7.elf File opened for reading /proc/23/stat bluefix.armv7.elf File opened for reading /proc/44/stat bluefix.armv7.elf File opened for reading /proc/338/stat bluefix.armv7.elf File opened for reading /proc/640/stat bluefix.armv7.elf File opened for reading /proc/765/stat bluefix.armv7.elf File opened for reading /proc/31/stat bluefix.armv7.elf File opened for reading /proc/811/stat bluefix.armv7.elf File opened for reading /proc/46/stat bluefix.armv7.elf File opened for reading /proc/201/stat bluefix.armv7.elf File opened for reading /proc/25/stat bluefix.armv7.elf File opened for reading /proc/7/stat bluefix.armv7.elf File opened for reading /proc/12/stat bluefix.armv7.elf File opened for reading /proc/21/stat bluefix.armv7.elf File opened for reading /proc/meminfo bluefix.armv7.elf File opened for reading /proc/56/stat bluefix.armv7.elf File opened for reading /proc/24/stat bluefix.armv7.elf File opened for reading /proc/6/stat bluefix.armv7.elf File opened for reading /proc/812/stat bluefix.armv7.elf File opened for reading /proc/3/stat bluefix.armv7.elf File opened for reading /proc/13/stat bluefix.armv7.elf File opened for reading /proc/26/stat bluefix.armv7.elf File opened for reading /proc/33/stat bluefix.armv7.elf File opened for reading /proc/51/stat bluefix.armv7.elf File opened for reading /proc/371/stat bluefix.armv7.elf File opened for reading /proc/624/stat bluefix.armv7.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.xmrlock bluefix.armv7.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.xmrlock
- Size 4B
- SHA256 99609216d723c87c90d42d4f3b41ad2374c4246cdc10e9bd2ce85c416d6758b0
- MD5 1b279eff33431a85062b73eedae9f433
- SHA1 363fb31429fb909de1a071fae541f238b6a752bc
- SHA512 7e28fde8b4d3d4178f4d78c59d2b81e8e589d4730d664148e73bfc3fe3dd8a22128b18c983c35f4bf91a12dd4eea1fdf46f9cd96343500e80994a43283758a05
- MD5 SHA1 SHA512