Overview

overview

10

Static

static

10

root.16_a1...42.bin

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    22s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    24/10/2026, 14:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    root.16_a151d3f4f242.bin
  • Size 3.2MB
  • Sample261024-rb3fwsvtfz
  • SHA256 a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexectionexecutionxmrigminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Modifies the dynamic linker configuration file 2 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    exectionpersistenceprivilege_escalationdefense_evasion
  • XMRig Miner payload 1 IoCs
    miner
  • Executes dropped EXE 2 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 6 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 2 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 6 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 6 IoCs
  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 28 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/root.16_a151d3f4f242.bin
    /tmp/root.16_a151d3f4f242.bin
    1⤵
    • Renames itself
    • Reads CPU attributes
    PID:1508
  • /tmp/.16
    /tmp/.16
    1⤵
    • Modifies the dynamic linker configuration file
    • Executes dropped EXE
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies systemd
    • Write file to user bin folder
    • Modifies Bash startup script
    • Changes its process name
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1508
    • /bin/sh
      sh -c "LD_PRELOAD=/usr/local/lib/libcommon.so.bak timeout 20 /usr/bin/top -b -d 1 >/dev/null 2>&1; rc=\$?; if [ \$rc -eq 0 ] || [ \$rc -eq 124 ]; then echo 1; else echo 0; fi"
      2⤵
        PID:1511
        • /usr/bin/timeout
          timeout 20 /usr/bin/top -b -d 1
          3⤵
            PID:1512
            • /usr/bin/top
              /usr/bin/top -b -d 1
              4⤵
              • Reads CPU attributes
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              PID:1513
        • /bin/sh
          sh -c "/bin/systemctl daemon-reload >/dev/null 2>&1"
          2⤵
            PID:1526
            • /bin/systemctl
              /bin/systemctl daemon-reload
              3⤵
                PID:1527
            • /bin/sh
              sh -c "/bin/systemctl enable system-helper.timer >/dev/null 2>&1"
              2⤵
                PID:1548
                • /bin/systemctl
                  /bin/systemctl enable system-helper.timer
                  3⤵
                    PID:1549
                • /bin/sh
                  sh -c "/bin/systemctl start system-helper.timer >/dev/null 2>&1"
                  2⤵
                    PID:1570
                    • /bin/systemctl
                      /bin/systemctl start system-helper.timer
                      3⤵
                        PID:1571
                    • /bin/sh
                      sh -c "/bin/systemctl is-active --quiet system-helper.timer"
                      2⤵
                        PID:1573
                        • /bin/systemctl
                          /bin/systemctl is-active --quiet system-helper.timer
                          3⤵
                            PID:1574
                        • /bin/sh
                          sh -c "pgrep -x '16' 2>/dev/null"
                          2⤵
                            PID:1575
                            • /usr/bin/pgrep
                              pgrep -x 16
                              3⤵
                              • Reads runtime system information
                              PID:1576
                          • /bin/sh
                            sh -c "pgrep -x '.16' 2>/dev/null"
                            2⤵
                              PID:1577
                              • /usr/bin/pgrep
                                pgrep -x .16
                                3⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:1578
                            • /bin/sh
                              sh -c "/usr/bin/env -u SSH_TTY SSH_CONNECTION=test BASH_ENV=/root/.bashrc /bin/bash -c 'printf __TTY_GUARD_OK__' 2>/dev/null"
                              2⤵
                                PID:1579
                                • /usr/bin/env
                                  /usr/bin/env -u SSH_TTY "SSH_CONNECTION=test" "BASH_ENV=/root/.bashrc" /bin/bash -c "printf __TTY_GUARD_OK__"
                                  3⤵
                                    PID:1580
                                  • /bin/bash
                                    /bin/bash -c "printf __TTY_GUARD_OK__"
                                    3⤵
                                      PID:1580
                                  • /bin/sh
                                    sh -c "/usr/bin/env SSH_TTY=/dev/pts/test SSH_CONNECTION=test BASH_ENV=/root/.bashrc /bin/bash -c 'printf __TTY_GUARD_OK__' 2>/dev/null"
                                    2⤵
                                      PID:1581
                                      • /usr/bin/env
                                        /usr/bin/env "SSH_TTY=/dev/pts/test" "SSH_CONNECTION=test" "BASH_ENV=/root/.bashrc" /bin/bash -c "printf __TTY_GUARD_OK__"
                                        3⤵
                                          PID:1582
                                        • /bin/bash
                                          /bin/bash -c "printf __TTY_GUARD_OK__"
                                          3⤵
                                            PID:1582
                                        • /bin/sh
                                          sh -c "/usr/bin/env -u SSH_TTY SSH_CONNECTION=test BASH_ENV=/root/.bashrc /bin/bash -c 'printf __TTY_GUARD_OK__' 2>/dev/null"
                                          2⤵
                                            PID:1583
                                            • /usr/bin/env
                                              /usr/bin/env -u SSH_TTY "SSH_CONNECTION=test" "BASH_ENV=/root/.bashrc" /bin/bash -c "printf __TTY_GUARD_OK__"
                                              3⤵
                                                PID:1584
                                              • /bin/bash
                                                /bin/bash -c "printf __TTY_GUARD_OK__"
                                                3⤵
                                                  PID:1584
                                              • /bin/sh
                                                sh -c "/usr/bin/env SSH_TTY=/dev/pts/test SSH_CONNECTION=test BASH_ENV=/root/.bashrc /bin/bash -c 'printf __TTY_GUARD_OK__' 2>/dev/null"
                                                2⤵
                                                  PID:1585
                                                  • /usr/bin/env
                                                    /usr/bin/env "SSH_TTY=/dev/pts/test" "SSH_CONNECTION=test" "BASH_ENV=/root/.bashrc" /bin/bash -c "printf __TTY_GUARD_OK__"
                                                    3⤵
                                                      PID:1586
                                                    • /bin/bash
                                                      /bin/bash -c "printf __TTY_GUARD_OK__"
                                                      3⤵
                                                        PID:1586
                                                    • /bin/sh
                                                      sh -c "crontab -l 2>/dev/null"
                                                      2⤵
                                                        PID:1587
                                                        • /usr/bin/crontab
                                                          crontab -l
                                                          3⤵
                                                            PID:1588
                                                        • /bin/sh
                                                          sh -c "ps -eo pid,comm,%cpu 2>/dev/null | awk '\$2==\"16\"' 2>/dev/null | sort -k3nr 2>/dev/null | awk 'NR>1{print \$1}' 2>/dev/null | xargs -r kill 2>/dev/null"
                                                          2⤵
                                                            PID:1591
                                                            • /usr/bin/xargs
                                                              xargs -r kill
                                                              3⤵
                                                                PID:1596
                                                              • /usr/bin/sort
                                                                sort -k3nr
                                                                3⤵
                                                                  PID:1594
                                                                • /usr/bin/awk
                                                                  awk "NR>1{print \$1}"
                                                                  3⤵
                                                                    PID:1595
                                                                  • /usr/bin/awk
                                                                    awk "\$2==\"16\""
                                                                    3⤵
                                                                      PID:1593
                                                                    • /bin/ps
                                                                      ps -eo "pid,comm,%cpu"
                                                                      3⤵
                                                                      • Reads runtime system information
                                                                      PID:1592
                                                                  • /bin/sh
                                                                    sh -c "pids=\$(pgrep -x '16' 2>/dev/null) && [ -n \"\$pids\" ] && [ \"\$(echo \"\$pids\" | wc -l 2>/dev/null)\" -gt 1 ] 2>/dev/null && echo \"\$pids\" | xargs -r ps -o pid=,pcpu= -p 2>/dev/null | sort -k2 -nr 2>/dev/null | awk 'NR>1 {print \$1}' 2>/dev/null | xargs -r kill -9 2>/dev/null"
                                                                    2⤵
                                                                      PID:1597
                                                                      • /usr/bin/pgrep
                                                                        pgrep -x 16
                                                                        3⤵
                                                                        • Reads runtime system information
                                                                        PID:1598
                                                                      • /usr/bin/wc
                                                                        wc -l
                                                                        3⤵
                                                                          PID:1601
                                                                      • /bin/sh
                                                                        sh -c "(ps -o pid=,pcpu= -C '16' 2>/dev/null || ps -eo pid,pcpu,comm 2>/dev/null | grep '16' 2>/dev/null | grep -v grep 2>/dev/null) 2>/dev/null | tr -s ' ' 2>/dev/null | sort -k2 -nr 2>/dev/null | tail -n +2 2>/dev/null | cut -d' ' -f1 2>/dev/null | while read pid; do [ -n \"\$pid\" ] && kill -9 \"\$pid\" 2>/dev/null; done"
                                                                        2⤵
                                                                          PID:1602
                                                                          • /usr/bin/sort
                                                                            sort -k2 -nr
                                                                            3⤵
                                                                              PID:1605
                                                                            • /usr/bin/cut
                                                                              cut "-d " -f1
                                                                              3⤵
                                                                                PID:1607
                                                                              • /usr/bin/tail
                                                                                tail -n +2
                                                                                3⤵
                                                                                  PID:1606
                                                                                • /usr/bin/tr
                                                                                  tr -s " "
                                                                                  3⤵
                                                                                    PID:1604
                                                                                  • /bin/ps
                                                                                    ps -o "pid=,pcpu=" -C 16
                                                                                    3⤵
                                                                                    • Reads CPU attributes
                                                                                    • Reads runtime system information
                                                                                    PID:1609
                                                                                • /tmp/init
                                                                                  init
                                                                                  2⤵
                                                                                  • Enumerates kernel/hardware configuration
                                                                                  PID:1634
                                                                                • /bin/sh
                                                                                  sh -c "pkill -9 -f '.b0s'; pkill -9 -f 'b0s'; pkill -9 -f 'yum.log'; pkill -9 -f 'apt.log'; rm -f \"\$HOME/.bash_history\" /var/tmp/apt.log /var/tmp/yum.log"
                                                                                  2⤵
                                                                                    PID:1635
                                                                                    • /usr/bin/pkill
                                                                                      pkill -9 -f .b0s
                                                                                      3⤵
                                                                                      • Reads CPU attributes
                                                                                      • Reads runtime system information
                                                                                      PID:1636
                                                                                  • /usr/local/sbin/ssh-session-gate
                                                                                    /usr/local/sbin/ssh-session-gate
                                                                                    2⤵
                                                                                    • Reads CPU attributes
                                                                                    PID:1637
                                                                                    • /bin/sh
                                                                                      sh -c "eval \"printf %s\\\\\\\\0 x \$1 \$2\"" sh sftp-server "2>/dev/null"
                                                                                      3⤵
                                                                                        PID:1638
                                                                                    • /usr/lib/openssh/sftp-server
                                                                                      /usr/lib/openssh/sftp-server
                                                                                      2⤵
                                                                                        PID:1637
                                                                                      • /usr/sbin/sshd
                                                                                        sshd -t -f /etc/ssh/sshd_config.new.1510
                                                                                        2⤵
                                                                                          PID:1639

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Reconnaissance

                                                                                            Resource Development

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Scheduled Task/Job

                                                                                            1
                                                                                            T1053

                                                                                            Cron

                                                                                            1
                                                                                            T1053.003

                                                                                            Shared Modules

                                                                                            1
                                                                                            T1129

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            XDG Autostart Entries

                                                                                            1
                                                                                            T1547.013

                                                                                            Create or Modify System Process

                                                                                            1
                                                                                            T1543

                                                                                            Systemd Service

                                                                                            1
                                                                                            T1543.002

                                                                                            Event Triggered Execution

                                                                                            1
                                                                                            T1546

                                                                                            Unix Shell Configuration Modification

                                                                                            1
                                                                                            T1546.004

                                                                                            Hijack Execution Flow

                                                                                            2
                                                                                            T1574

                                                                                            Dynamic Linker Hijacking

                                                                                            1
                                                                                            T1574.006

                                                                                            Path Interception by PATH Environment Variable

                                                                                            1
                                                                                            T1574.007

                                                                                            Scheduled Task/Job

                                                                                            1
                                                                                            T1053

                                                                                            Cron

                                                                                            1
                                                                                            T1053.003

                                                                                            Privilege Escalation

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            XDG Autostart Entries

                                                                                            1
                                                                                            T1547.013

                                                                                            Create or Modify System Process

                                                                                            1
                                                                                            T1543

                                                                                            Systemd Service

                                                                                            1
                                                                                            T1543.002

                                                                                            Event Triggered Execution

                                                                                            1
                                                                                            T1546

                                                                                            Unix Shell Configuration Modification

                                                                                            1
                                                                                            T1546.004

                                                                                            Hijack Execution Flow

                                                                                            2
                                                                                            T1574

                                                                                            Dynamic Linker Hijacking

                                                                                            1
                                                                                            T1574.006

                                                                                            Path Interception by PATH Environment Variable

                                                                                            1
                                                                                            T1574.007

                                                                                            Scheduled Task/Job

                                                                                            1
                                                                                            T1053

                                                                                            Cron

                                                                                            1
                                                                                            T1053.003

                                                                                            Defense Evasion

                                                                                            Hijack Execution Flow

                                                                                            2
                                                                                            T1574

                                                                                            Dynamic Linker Hijacking

                                                                                            1
                                                                                            T1574.006

                                                                                            Path Interception by PATH Environment Variable

                                                                                            1
                                                                                            T1574.007

                                                                                            Credential Access

                                                                                            Discovery

                                                                                            System Information Discovery

                                                                                            2
                                                                                            T1082

                                                                                            System Network Configuration Discovery

                                                                                            1
                                                                                            T1016

                                                                                            Internet Connection Discovery

                                                                                            1
                                                                                            T1016.001

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Command and Control

                                                                                            Exfiltration

                                                                                            Impact

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            cron_d_1019
                                                                                            • Path /etc/cron.d/cron_d_1019
                                                                                            • Size 49B
                                                                                            • SHA256 3124fce103919aabe08201978fba68d58b41b2f08b58c925a94a6b2ef9cd8f0c
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            system-helper
                                                                                            • Path /etc/cron.d/system-helper
                                                                                            • Size 480B
                                                                                            • SHA256 22b061c3496ccb0599ad22aca675eb6d67d417663b72868d1c024b6426cdd659
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            libbase.sh.tmp.1510
                                                                                            • Path /etc/profile.d/libbase.sh.tmp.1510
                                                                                            • Size 342B
                                                                                            • SHA256 9ef11ca1cb146c1b5b4d29c9323cda12db0237789edad23800785593b4255d16
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            libcommon.csh.tmp.1510
                                                                                            • Path /etc/profile.d/libcommon.csh.tmp.1510
                                                                                            • Size 233B
                                                                                            • SHA256 da2befb53522da339f178c8272d9a0c74d5f329065744294c49b52009d168d9a
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            sshd_config.new.1510
                                                                                            • Path /etc/ssh/sshd_config.new.1510
                                                                                            • Size 3KB
                                                                                            • SHA256 f7a102eef769e42ad2ced68a75a257088243ce41f68f296277906a0c0cd2f47d
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            system-helper.service
                                                                                            • Path /etc/systemd/system/system-helper.service
                                                                                            • Size 154B
                                                                                            • SHA256 4c655133bb98c591838a770e9d70bbb2aaca62dc4ec1ae67ec22ddd1d5da5fea
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            system-helper-run
                                                                                            • Path /usr/local/bin/system-helper-run
                                                                                            • Size 221B
                                                                                            • SHA256 74e7112def51baeceac4800ae036bd77474e41c7263dad4aa1d5f5df00ba8a16
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            libbase.sh.tmp.1510
                                                                                            • Path /usr/local/libexec/libbase.sh.tmp.1510
                                                                                            • Size 3.2MB
                                                                                            • SHA256 a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download