xmrig_linux | ae554675166505008457bd83a1e1fdf1034fd45990422492bc86c0e161b42fe7

Analysis

max time kernel
1s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
26/09/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae554675166505008457bd83a1e1fdf1034fd45990422492bc86c0e161b42fe7
Size 5KB
Sample260926-3ekwsstema
SHA256 ae554675166505008457bd83a1e1fdf1034fd45990422492bc86c0e161b42fe7
MD5 c370cf99ec58fdbba9110dcd7f870e30
SHA1 5893efa05aaad99c565e7c9e56fdfdad7408d341
SHA512 cfc569528db59d2364f9ac2f983c0617ee265f5d2f2c88470191a9a66f21067aedc1126c6ad033391f3c50add9eb026f1ba245d66136df0c39c901e71eb06429
SSDEEP 96:wMBbM2X8Gp91ovZam9TOJXW/ch5EnFUytLjcEqjJ6bb6zsyTRcmHuB/M4XVAtf5:wMBbM2pDmAm8JQy9F6Szs2RtuB04FAf5
TLSH
T18EB1BA62F534583355899474EECB220338732E5B03247C6CA1EB7928367D77A323ABB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xmrig_linux miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1518	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/xmrig	1519	ae554675166505008457bd83a1e1fdf1034fd45990422492bc86c0e161b42fe7

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.pRa4iHiWQX	mktemp
File opened for modification	/tmp/tmp.pRa4iHiWQX	curl
File opened for modification	/tmp/tmp.hQFZmOc1Go/xmrig.tar.gz	curl
File opened for modification	/tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/SHA256SUMS	tar
File opened for modification	/tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/xmrig	tar
File opened for modification	/tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/config.json	tar

/tmp/ae554675166505008457bd83a1e1fdf1034fd45990422492bc86c0e161b42fe7
/tmp/ae554675166505008457bd83a1e1fdf1034fd45990422492bc86c0e161b42fe7
1⤵
- Executes dropped EXE
PID:1484
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:1486
- /bin/uname
  uname -m
  2⤵
  PID:1487
- /bin/mktemp
  mktemp -d
  2⤵
  PID:1488
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:1490
- /usr/bin/curl
  curl -fsSL --max-time 20 https://api.github.com/repos/xmrig/xmrig/releases/latest -o /tmp/tmp.pRa4iHiWQX
  2⤵
  - Writes file to tmp directory
  PID:1491
- /usr/bin/head
  head -1
  2⤵
  PID:1499
- /bin/sed
  sed -n "s/.*\"tag_name\": *\"\\([^\"]*\\)\".*/\\1/p" /tmp/tmp.pRa4iHiWQX
  2⤵
  - Reads runtime system information
  PID:1498
- /usr/bin/head
  head -1
  2⤵
  PID:1504
- /bin/grep
  grep -E "linux-static-x64|linux--x64|noble-x64|jammy-x64|focal-x64|linux-x64|linux-arm64"
  2⤵
  PID:1503
- /bin/sed
  sed "s/\"name\": *\"//;s/\"//"
  2⤵
  - Reads runtime system information
  PID:1502
- /bin/grep
  grep -o "\"name\": *\"[^\"]*\"" /tmp/tmp.pRa4iHiWQX
  2⤵
  PID:1501
- /usr/bin/head
  head -1
  2⤵
  PID:1508
- /bin/sed
  sed -n "s/.*\"digest\": *\"sha256:\\([a-f0-9]*\\)\".*/\\1/p"
  2⤵
  - Reads runtime system information
  PID:1507
- /bin/grep
  grep -A 3 "\"name\": \"xmrig-6.26.0-focal-x64.tar.gz\"" /tmp/tmp.pRa4iHiWQX
  2⤵
  PID:1506
- /bin/rm
  rm -f /tmp/tmp.pRa4iHiWQX
  2⤵
  PID:1509
- /usr/bin/curl
  curl -fsSL --max-time 600 https://github.com/xmrig/xmrig/releases/download/v6.26.0/xmrig-6.26.0-focal-x64.tar.gz -o /tmp/tmp.hQFZmOc1Go/xmrig.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/tar
  tar -xzf /tmp/tmp.hQFZmOc1Go/xmrig.tar.gz -C /tmp/tmp.hQFZmOc1Go
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1513
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1514
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1514
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1514
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1514
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1514
- - /bin/gzip
    gzip -d
    3⤵
    PID:1514
- /usr/bin/head
  head -1
  2⤵
  PID:1517
- /usr/bin/find
  find /tmp/tmp.hQFZmOc1Go -maxdepth 2 -name xmrig -type f
  2⤵
  - Reads runtime system information
  PID:1516
- /bin/chmod
  chmod +x /tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/xmrig
  /tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/xmrig --version
  2⤵
  PID:1519
- /bin/rm
  rm -rf /tmp/tmp.hQFZmOc1Go
  2⤵
  PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SHA256SUMS

Path /tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/SHA256SUMS
Size 150B
SHA256 f1b789d859b2d077440f401163a95fad101c6366de0d418a051d81ef86eadaed
MD5 900f1b3db05c7e2671601b6bddced180
SHA1 8850c0d22d7ae646819cfd71e73d8d2ba35d5e9e
SHA512 b8ccfa6a2b9e3127bc4fd823d24dd4532ae7ebe543cf7315a331b0e6c535f93b52619db8e74e3b5d6573fe9b7c13eb9d73e57614aaf3a39a372f340b4e11c5a9
TLSH
T161C08CBD1885DA99422F4605AEB438868A063B0D3A45AA169561249B84690D18B0FD2D
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/config.json
Size 2KB
SHA256 a6a710135483296b9a943dc3ed31d6a1396b5cfeb127ab0d7e5c6bf49785130a
MD5 54e9f45448cfc5c6f2506cf89d771fd5
SHA1 c9de25d2c995d1ba2eda402dbe03c409909b842b
SHA512 d616e929fe91d14976a26e511ec50f8f3520924349d3eb04ab785787224f8cd53ed69ba4978a61e6e7f3b6f4e26a69d7d41b59e31d7339ee250c3ea332bae485
TLSH
T17841AD25C9780CBA0294A0BC88EDA293462881075F593C3CB54C995C2F0E73E76B6BE6
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/tmp.hQFZmOc1Go/xmrig-6.26.0/xmrig
Size 9.0MB
SHA256 4f939dcd518a040af2c085b3c8113e6c00a98ddd6ef08c60de88bde4e13571a1
MD5 2971ed8fe3095f09502c5fc870d2b57d
SHA1 c32bf81573b81372284de8ad38e377bab265f71f
SHA512 51501160249d32bebc776fdf815cffa66749e50bec42ea14503e57afea562a33f6deb5681dc4fc0c7bf4dc2dbd82ba16ceebb41534a90e33050fa31ac2c680cd
SSDEEP 196608:7H/7LjD5aO6TJU8Qw/wyWLBaJpg2UIDLmziHhu+P:rjDe4cjHhRP
TLSH
T1F1965C1BF5A314BCC0BED430466FD2336935B89842357A7B2694AE302E63F60576DFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmrig.tar.gz

Path /tmp/tmp.hQFZmOc1Go/xmrig.tar.gz
Size 3.6MB
SHA256 a49c08f780484d0a50e18065132228556c64e857bb6783ebf1da3eec0beceee6
MD5 c9b7d55309ae3f2e5b5b5d515859f06e
SHA1 e2148a27a2cf3c43bad418ae62579edbb4afa36b
SHA512 58bd163e966f88b4deaabc921bc9e82014b3a97bdc126fe854c5a66e0a24d27ff9f4ad0bca4ee1a2804b1917a3ffab868d864964602933b5577f7771adcd6cdc
SSDEEP 98304:o80BHlEXdzuwwlrvFqiQ69w/EZA8g7fWGt+x9q3QccH:ods4RvbQhMWV6SslH
TLSH
T1980633D94DA7EBB83692D07A6A400A2835C586F06B3973EEFC059377D8A2464DD0C7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads