xmrig_linux | c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898

Analysis

max time kernel
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01/07/2026, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsync/a/a
Size 6KB
Sample260701-avsmcsbv3n
SHA256 c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
MD5 69c7923ed59fb2c2b98952e2388c152b
SHA1 4d99ac7f50852ddfcb725330c2f2411d800be149
SHA512 41dedaf997c6a3a91b5db5bcbaded52fce41491585d470313ab54eb72c1d61d8e30a5fd4634f8764c9be026206f16ed4b6ce0de8cd26c9fd307f7d5f4499f594
SSDEEP 192:gfgH9BeKLOOuK/0HiBeKLOOuKvAV9HdnIllo:gfgDeg9ue0Seg9u8A7
TLSH
T13DD1FA0AF35857BBAD1D58E43CCB7D326C277696E4B10CE519C68781C8ECA4D78B021E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery xmrig_linux miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
697	chmod
696	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.rsync/a/upd	698	a

Attempts to change immutable files 1 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
701	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/systemtd	touch

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep

Reads CPU attributes 1 TTPs 22 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	a

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/312/status	pkill
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/653/status	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/645/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/685/stat	ps
File opened for reading	/proc/645/stat	killall
File opened for reading	/proc/644/stat	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/108/cmdline	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/647/status	ps
File opened for reading	/proc/157/status	ps
File opened for reading	/proc/599/cmdline	ps
File opened for reading	/proc/593/cmdline	pkill
File opened for reading	/proc/710/stat	ps
File opened for reading	/proc/233/stat	killall
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/600/status	ps
File opened for reading	/proc/599/status	ps
File opened for reading	/proc/306/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/108/cmdline	ps
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/292/cmdline	pkill
File opened for reading	/proc/671/status	ps
File opened for reading	/proc/671/cmdline	pkill
File opened for reading	/proc/147/stat	ps
File opened for reading	/proc/700/cmdline	ps
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/699/cmdline	pkill
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/787/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/675/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/599/status	pkill
File opened for reading	/proc/306/cmdline	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/647/status	pkill
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/699/status	ps

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.rsync/a/.proc	stop
File opened for modification	/tmp/.rsync/a/dir.dir	run
File opened for modification	/tmp/.rsync/a/bash.pid	run
File opened for modification	/tmp/.rsync/a/��@@8@@�?f@�@��!��!Q�tdV�	sh
File opened for modification	/tmp/.rsync/a/�z@��ر'8	sh
File opened for modification	/tmp/.rsync/a/dir.dir	a
File opened for modification	/tmp/.rsync/a/upd	a

/tmp/.rsync/a/a
/tmp/.rsync/a/a
1⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:677
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:678
- /bin/cat
  cat dir.dir
  2⤵
  PID:680
- /usr/bin/whoami
  whoami
  2⤵
  PID:681
- /usr/bin/id
  id -u
  2⤵
  PID:682
- /bin/rm
  rm -rf /usr/bin/systemtd
  2⤵
  PID:683
- /usr/bin/touch
  touch /usr/bin/systemtd
  2⤵
  - Write file to user bin folder
  PID:684
- /bin/chmod
  chmod -w /usr/bin
  2⤵
  PID:686
- /usr/bin/pkill
  pkill -9 "\\-bash"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:687
- /sbin/modprobe
  modprobe msr "allow_writes=on"
  2⤵
  PID:690
- /bin/grep
  grep -E "AMD Ryzen|AMD EPYC" /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:691
- /bin/grep
  grep Intel /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:692
- /usr/bin/nproc
  nproc
  2⤵
  PID:693
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=1"
  2⤵
  - Reads CPU attributes
  PID:694
- /usr/bin/find
  find "/sys/devices/system/node/node*" -maxdepth 0 -type d
  2⤵
  PID:695
- /bin/chmod
  chmod u+x upd
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /bin/chmod
  chmod 777 a crond delsshd dir.dir init01 init02 rmkwork run stop upd
  2⤵
  - File and Directory Permissions Modification
  PID:697
- /tmp/.rsync/a/upd
  ./upd
  2⤵
  PID:698

/tmp/.rsync/a/run
./run
1⤵
- Writes file to tmp directory
PID:699
- /tmp/.rsync/a/stop
  ./stop
  2⤵
  - Writes file to tmp directory
  PID:700
- - /usr/bin/chattr
    chattr -ia "~/.xmrig.json"
    3⤵
    - Attempts to change immutable files
    PID:701
- - /bin/rm
    rm -rf "~/.xmrig.json"
    3⤵
    PID:702
- - /usr/bin/pkill
    pkill -9 cron
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:703
- - /usr/bin/killall
    killall -9 cron
    3⤵
    PID:705
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:707
- - /bin/grep
    grep -v grep
    3⤵
    PID:709
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:710
- - /bin/grep
    grep cron
    3⤵
    PID:708
- - /usr/bin/pkill
    pkill -9 kswapd0
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:711
- - /usr/bin/killall
    killall -9 kswapd0
    3⤵
    PID:712
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:714
- - /bin/grep
    grep kswapd0
    3⤵
    PID:715
- - /bin/grep
    grep -v grep
    3⤵
    PID:716
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:717
- - /usr/bin/pkill
    pkill -9 ld-linux
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:718
- - /usr/bin/killall
    killall -9 ld-linux
    3⤵
    PID:719
- - /bin/grep
    grep ld-linux
    3⤵
    PID:722
- - /bin/grep
    grep -v grep
    3⤵
    PID:723
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:724
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:721
- - /usr/bin/pkill
    pkill -9 Donald
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:725
- - /usr/bin/killall
    killall -9 Donald
    3⤵
    - Reads runtime system information
    PID:726
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:728
- - /bin/grep
    grep Donald
    3⤵
    PID:729
- - /bin/grep
    grep -v grep
    3⤵
    PID:730
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:731
- - /usr/bin/pkill
    pkill -9 xmr
    3⤵
    - Reads CPU attributes
    PID:735
- - /usr/bin/killall
    killall -9 xmr
    3⤵
    - Reads runtime system information
    PID:738
- - /bin/grep
    grep xmr
    3⤵
    PID:743
- - /bin/grep
    grep -v grep
    3⤵
    PID:744
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:745
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:742
- - /usr/bin/pkill
    pkill -9 "@notty"
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:749
- - /usr/bin/killall
    killall -9 "@notty"
    3⤵
    PID:752
- - /bin/grep
    grep "@notty"
    3⤵
    PID:757
- - /bin/grep
    grep -v grep
    3⤵
    PID:758
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:759
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:756
- - /bin/rm
    rm -rf .proc
    3⤵
    PID:764
- - /usr/bin/pkill
    pkill -9 kauditd0
    3⤵
    - Reads CPU attributes
    PID:765
- - /usr/bin/killall
    killall -9 kauditd0
    3⤵
    - Reads runtime system information
    PID:769
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:773
- - /bin/grep
    grep -v grep
    3⤵
    PID:775
- - /bin/grep
    grep kauditd0
    3⤵
    PID:774
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:776
- - /bin/rm
    rm -rf .proc
    3⤵
    PID:780
- - /usr/bin/pkill
    pkill -9 apache2
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:781
- - /usr/bin/killall
    killall -9 apache2
    3⤵
    PID:785
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:790
- - /bin/grep
    grep apache2
    3⤵
    PID:791
- - /bin/grep
    grep -v grep
    3⤵
    PID:792
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:793
- - /usr/bin/pkill
    pkill -9 superset
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:801
- - /usr/bin/killall
    killall -9 superset
    3⤵
    PID:805
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:809
- - /bin/grep
    grep superset
    3⤵
    PID:810
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:812
- - /bin/grep
    grep -v grep
    3⤵
    PID:811
- - /bin/rm
    rm -rf "~/c3pool"
    3⤵
    PID:813
- - /usr/bin/pkill
    pkill -9 xmrig
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:814
- - /usr/bin/killall
    killall -9 xmrig
    3⤵
    - Reads runtime system information
    PID:816
- - /bin/grep
    grep xmrig
    3⤵
    PID:819
- - /bin/ps
    ps x
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:818
- - /usr/bin/awk
    awk "{print \$1}"
    3⤵
    PID:821
- - /bin/grep
    grep -v grep
    3⤵
    PID:820
- /bin/sleep
  sleep 5
  2⤵
  PID:822
- /bin/cat
  cat dir.dir
  2⤵
  PID:855
- /bin/pidof
  pidof crond
  2⤵
  PID:857
- /usr/bin/nohup
  nohup ./crond
  2⤵
  PID:856
- /tmp/.rsync/a/crond
  ./crond
  2⤵
  PID:856
- /bin/sh
  /bin/sh ./crond
  2⤵
  - Writes file to tmp directory
  PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dir.dir

Path /tmp/.rsync/a/dir.dir
Size 14B
SHA256 ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
MD5 b3d878adcf4672bbd1f31cffac10c769
SHA1 ce5798837933ece35a7e26a0a3dc06cab19c6275
SHA512 019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
MD5 SHA1 SHA512

Submit Download

upd

Path /tmp/.rsync/a/upd
Size 175B
SHA256 419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46
MD5 a136fbe534c2487d3c89bd6a26847bd0
SHA1 11b9362ba79b67dd5d5baf7cf11e0003f049d6e0
SHA512 85047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9
TLSH
T1F2C08C84B0273D16B52A6ABD30292E311099E80D0814174201D8CD73E36F046F180A10
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads