Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
xmrig.x86_64

Overview

General Information

Sample Name:xmrig.x86_64
Analysis ID:1299172
MD5:c203754b371925fbab487056978ad7a4
SHA1:de61424587410be5dc3f55110e373574edeabb93
SHA256:1d320d51112189f76669b97b582345091a2d5dc5df3b6d7379eeb82159f68fc4
Infos:

Detection

Xmrig
Score:92
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
Malicious sample detected (through community Yara rule)
Found strings related to Crypto-Mining
Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher)
Sample tries to persist itself using cron
Executes the "crontab" command typically for achieving persistence
Sample is packed with UPX
Tries to load the MSR kernel module used for reading/writing to CPUs model specific register
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample contains only a LOAD segment without any section mappings
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Reads system information from the proc file system
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
ELF contains segments with high entropy indicating compressed/encrypted content
Executes the "modprobe" command used for loading kernel modules
Executes commands using a shell command-line interpreter
Reads CPU information from /proc indicative of miner or evasive malware
Executes the "rm" command used to delete files or directories

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox Version:38.0.0 Beryl
Analysis ID:1299172
Start date and time:2023-08-29 08:59:15 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 35s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:xmrig.x86_64
Detection:MAL
Classification:mal92.troj.evad.mine.linX86_64@0/3@0/0
  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/tmp/xmrig.x86_64
PID:6214
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • xmrig.x86_64 (PID: 6214, Parent: 6111, MD5: c203754b371925fbab487056978ad7a4) Arguments: /tmp/xmrig.x86_64
    • sh (PID: 6215, Parent: 6214, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab -l"
      • sh New Fork (PID: 6216, Parent: 6215)
      • crontab (PID: 6216, Parent: 6215, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
    • sh (PID: 6217, Parent: 6214, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"@reboot /tmp/xmrig.x86_64\" | crontab -"
      • sh New Fork (PID: 6218, Parent: 6217)
      • sh New Fork (PID: 6219, Parent: 6217)
      • crontab (PID: 6219, Parent: 6217, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -
    • xmrig.x86_64 New Fork (PID: 6220, Parent: 6214)
      • sh (PID: 6236, Parent: 6220, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
        • sh New Fork (PID: 6237, Parent: 6236)
        • modprobe (PID: 6237, Parent: 6236, MD5: 0b44462b1a40df8039d6d61cfff7ea84) Arguments: /sbin/modprobe msr allow_writes=on
  • dash New Fork (PID: 6296, Parent: 4331)
  • rm (PID: 6296, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.2PtsmUDOSW /tmp/tmp.PjFhvnRwmF /tmp/tmp.3sRtdkblqA
  • cleanup

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpLinux_Trojan_Pornoasset_927f314funknownunknown
    • 0x217c58:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
    Process Memory Space: xmrig.x86_64 PID: 6214JoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      • • AV Detection
      • • Bitcoin Miner
      • • Networking
      • • System Summary
      • • Data Obfuscation
      • • Persistence and Installation Behavior
      • • Hooking and other Techniques for Hiding and Protection
      • • Malware Analysis System Evasion

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: xmrig.x86_64Virustotal: Detection: 9%Perma Link

      Bitcoin Miner

      barindex
      Source: Yara matchFile source: 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: xmrig.x86_64 PID: 6214, type: MEMORYSTR
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: stratum+ssl://randomx.xmrig.com:443
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: cryptonight/0
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: -o, --url=URL URL of mining server
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: stratum+tcp://
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
      Source: /tmp/xmrig.x86_64 (PID: 6220)MSR open for writing: /dev/cpu/0/msrJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)MSR open for writing: /dev/cpu/1/msrJump to behavior
      Source: /bin/sh (PID: 6237)Modprobe: /sbin/modprobe -> /sbin/modprobe msr allow_writes=onJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/possibleJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: http://download.asyncfox.xyz/download/xmrig.x86_64;
      Source: xmrig.x86_64String found in binary or memory: http://upx.sf.net
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://gcc.gnu.org/bugs
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://gcc.gnu.org/bugsNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEENSt7__cxx1119basic_is
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://xmrig.com/benchmark/%s
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://xmrig.com/docs/algorith
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://xmrig.com/docs/algorithms
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://xmrig.com/wizard
      Source: xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpString found in binary or memory: https://xmrig.com/wizard%s

      System Summary

      barindex
      Source: 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
      Source: LOAD without section mappingsProgram segment: 0x0
      Source: 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
      Source: classification engineClassification label: mal92.troj.evad.mine.linX86_64@0/3@0/0

      Data Obfuscation

      barindex
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 4.02 Copyright (C) 1996-2023 the UPX Team. All Rights Reserved. $

      Persistence and Installation Behavior

      barindex
      Source: /usr/bin/crontab (PID: 6219)File: /var/spool/cron/crontabs/tmp.P2uogqJump to behavior
      Source: /usr/bin/crontab (PID: 6219)File: /var/spool/cron/crontabs/rootJump to behavior
      Source: /bin/sh (PID: 6216)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
      Source: /bin/sh (PID: 6219)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)File: /proc/6214/mountsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads from proc file: /proc/cpuinfoJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads from proc file: /proc/meminfoJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)Reads from proc file: /proc/meminfoJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1582/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/3088/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/230/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/110/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/231/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/111/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/232/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1579/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/112/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/233/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1699/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/113/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/234/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1335/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1698/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/114/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/235/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1334/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1576/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/2302/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/115/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/236/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/116/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/237/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/117/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/118/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/910/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/119/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/912/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/10/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/2307/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/11/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/918/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/12/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/13/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/14/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/15/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/16/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/17/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/18/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1594/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/120/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/121/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1349/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/122/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/243/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/123/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/2/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/124/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/3/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/4/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/125/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/126/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1344/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1465/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1586/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/127/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/6/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/248/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/128/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/249/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1463/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/800/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/9/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/801/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/20/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/21/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1900/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/22/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/23/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/24/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/25/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/26/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/27/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/28/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/29/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/491/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/250/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/130/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/251/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/252/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/132/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/253/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/254/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/255/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/256/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1599/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/257/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1477/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/379/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/258/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1476/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/259/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1475/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/936/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/30/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/2208/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/35/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/6146/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1809/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/1494/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/260/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/261/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)File opened: /proc/141/mapsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6215)Shell command executed: sh -c "crontab -l"Jump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6217)Shell command executed: sh -c "echo \"@reboot /tmp/xmrig.x86_64\" | crontab -"Jump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6236)Shell command executed: sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"Jump to behavior
      Source: /usr/bin/dash (PID: 6296)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.2PtsmUDOSW /tmp/tmp.PjFhvnRwmF /tmp/tmp.3sRtdkblqAJump to behavior
      Source: submitted sampleStderr: no crontab for root: exit code = 0
      Source: xmrig.x86_64Submission file: segment LOAD with 7.8133 entropy (max. 8.0)
      Source: xmrig.x86_64Submission file: segment LOAD with 7.9999 entropy (max. 8.0)
      Source: /bin/sh (PID: 6237)Modprobe: /sbin/modprobe -> /sbin/modprobe msr allow_writes=onJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/idJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from /sys: /sys/devices/system/cpu/possibleJump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Queries kernel information via 'uname': Jump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6220)Queries kernel information via 'uname': Jump to behavior
      Source: /sbin/modprobe (PID: 6237)Queries kernel information via 'uname': Jump to behavior
      Source: /tmp/xmrig.x86_64 (PID: 6214)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
      Source: xmrig.x86_64, 6214.1.00007eff86ea5000.00007eff86ea6000.rw-.sdmpBinary or memory string: VMware Virtual Platform
      Source: xmrig.x86_64, 6214.1.00007eff86c77000.00007eff86ce4000.rw-.sdmpBinary or memory string: vmwarep
      Source: xmrig.x86_64, 6214.1.00007eff86c77000.00007eff86ce4000.rw-.sdmpBinary or memory string: vmware
      Source: xmrig.x86_64, 6214.1.00007eff86ea5000.00007eff86ea6000.rw-.sdmpBinary or memory string: VMware, Inc.

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts1
      Scheduled Task/Job      		1
      Kernel Modules and Extensions      		1
      Kernel Modules and Extensions      		1
      Scripting      		1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default Accounts1
      Scripting      		1
      Scheduled Task/Job      		1
      Scheduled Task/Job      		11
      Obfuscated Files or Information      		LSASS Memory1
      File and Directory Discovery      		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain Accounts1
      At (Linux)      		1
      At (Linux)      		1
      At (Linux)      		1
      File Deletion      		Security Account Manager23
      System Information Discovery      		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1299172 Sample: xmrig.x86_64 Startdate: 29/08/2023 Architecture: LINUX Score: 92 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected Xmrig cryptocurrency miner 2->43 45 Sample is packed with UPX 2->45 8 xmrig.x86_64 2->8         started        11 dash rm 2->11         started        process3 signatures4 51 Found strings related to Crypto-Mining 8->51 53 Sample reads /proc/mounts (often used for finding a writable filesystem) 8->53 13 xmrig.x86_64 sh 8->13         started        15 xmrig.x86_64 8->15         started        18 xmrig.x86_64 sh 8->18         started        process5 signatures6 20 sh crontab 13->20         started        24 sh 13->24         started        55 Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher) 15->55 26 xmrig.x86_64 sh 15->26         started        28 xmrig.x86_64 15->28         started        30 sh crontab 18->30         started        process7 file8 35 /var/spool/cron/crontabs/tmp.P2uogq, ASCII 20->35 dropped 47 Sample tries to persist itself using cron 20->47 49 Executes the "crontab" command typically for achieving persistence 20->49 32 sh modprobe 26->32         started        signatures9 process10 signatures11 37 Tries to load the MSR kernel module used for reading/writing to CPUs model specific register 32->37

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      xmrig.x86_6411%ReversingLabs
      xmrig.x86_649%VirustotalBrowse

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://xmrig.com/benchmark/%s0%URL Reputationsafe
      https://xmrig.com/wizard0%URL Reputationsafe
      https://xmrig.com/wizard%s0%URL Reputationsafe
      https://xmrig.com/docs/algorithms0%URL Reputationsafe
      http://download.asyncfox.xyz/download/xmrig.x86_64;100%Avira URL Cloudmalware
      https://xmrig.com/docs/algorith0%Avira URL Cloudsafe
      http://download.asyncfox.xyz/download/xmrig.x86_64;11%VirustotalBrowse
      https://xmrig.com/docs/algorith0%VirustotalBrowse

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info
      NameSourceMaliciousAntivirus DetectionReputation
      http://download.asyncfox.xyz/download/xmrig.x86_64;xmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
      • 11%, Virustotal, Browse
      • Avira URL Cloud: malware
      		unknown
      http://upx.sf.netxmrig.x86_64false
        		high
        https://xmrig.com/benchmark/%sxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://xmrig.com/docs/algorithxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
        • 0%, Virustotal, Browse
        • Avira URL Cloud: safe
        		unknown
        https://xmrig.com/wizardxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://gcc.gnu.org/bugsNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEENSt7__cxx1119basic_isxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
          		high
          https://gcc.gnu.org/bugsxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
            		high
            https://xmrig.com/wizard%sxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://xmrig.com/docs/algorithmsxmrig.x86_64, 6214.1.00007eff86525000.00007eff86a78000.r-x.sdmpfalse
            • URL Reputation: safe
            		unknown

            World Map of Contacted IPs

            ⊘No contacted IP infos

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            Process:/tmp/xmrig.x86_64
            File Type:very short file (no magic)
            Category:dropped
            Size (bytes):1
            Entropy (8bit):0.0
            Encrypted:false
            SSDEEP:3:W:W
            MD5:ECCBC87E4B5CE2FE28308FD9F2A7BAF3
            SHA1:77DE68DAECD823BABBB58EDB1C8E14D7106E83BB
            SHA-256:4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
            SHA-512:3BAFBF08882A2D10133093A1B8433F50563B93C14ACD05B79028EB1D12799027241450980651994501423A66C276AE26C43B739BC65C4E16B10C3AF6C202AEBB
            Malicious:false
            Reputation:high, very likely benign file
            Preview:3
            Process:/tmp/xmrig.x86_64
            File Type:ASCII text, with no line terminators
            Category:dropped
            Size (bytes):4
            Entropy (8bit):1.5
            Encrypted:false
            SSDEEP:3:MRV:Mz
            MD5:537D9B6C927223C796CAC288CCED29DF
            SHA1:EA10E810F96FCA6858E37FDA9832ACE147EED87C
            SHA-256:0D21AE129A64E1D19E4A94DFCA3A67C777E17374E9D4CA2F74B65647A88119EA
            SHA-512:6D4B04576201F789368F251EA231F5D2C0AE4CF17E95851D3AE10A1825724502732289F830E06247465F0284D4E33A9A120F6D730E62483515556DC1FD9CD120
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:1040
            Process:/usr/bin/crontab
            File Type:ASCII text
            Category:dropped
            Size (bytes):201
            Entropy (8bit):5.249128116994473
            Encrypted:false
            SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQLv80CpGMQ5UYLtCFt3HYjXX7e:8QjHig84fxeHLUHYrre
            MD5:DFBFEC99A4678E8D361D2A82E82F9F68
            SHA1:4CAD543143BD88F2B8F9B76AFA252D79EC7F0A4C
            SHA-256:9613B77A8198106CB23237663D115EE1C5C085024131C4C1FF192A85773A9A6C
            SHA-512:5C14A5A42D75069660D3334D16B8573A7058965120C28295CE5923C3A110DBA7B5D3D1FB20732FEA6284A8EFA90D97207290ECEE2F958673DE9CAAD87B06C31B
            Malicious:true
            Reputation:low
            Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Tue Aug 29 08:59:58 2023).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@reboot /tmp/xmrig.x86_64.

            Static File Info

            General

            File type:ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, no section header
            Entropy (8bit):7.99989636352678
            TrID:
            • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
            • ELF Executable and Linkable format (generic) (4004/1) 49.84%
            File name:xmrig.x86_64
            File size:1'892'488 bytes
            MD5:c203754b371925fbab487056978ad7a4
            SHA1:de61424587410be5dc3f55110e373574edeabb93
            SHA256:1d320d51112189f76669b97b582345091a2d5dc5df3b6d7379eeb82159f68fc4
            SHA512:0757f737992964bf1f44492af7452c295df33540f1aee7a14ba787f0a21998f0be88870ae29b8358a87f416f59d1c4ea97acc7cce2b6fdf887570af340644624
            SSDEEP:24576:6cRlUQKOqhwZKvWVQakob78qjBInXElk2wWhpYl7tfun94rKxjbDusOYj116cw3m:6cHUE/F7PFIXI7Yl7tf28kDUWQsGHSj
            TLSH:DD9533E51C68659C6DD3B0F48543C30AF105E60C972847FF9C2B335A66A1AB0DB5B3AE
            File Content Preview:.ELF..............>.............@...................@.8.................................................P.{...... ........................|.......|.....-.......-........ ......Q.td........................................................UPX!$.......H.X.a&U

            Static ELF Info

            ELF header

            Class:ELF64
            Data:2's complement, little endian
            Version:1 (current)
            Machine:Advanced Micro Devices X86-64
            Version Number:0x1
            Type:DYN (Shared object file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x98ca18
            Flags:0x0
            ELF Header Size:64
            Program Header Offset:64
            Program Header Size:56
            Number of Program Headers:3
            Section Header Offset:0
            Section Header Size:0
            Number of Section Headers:0
            Header String Table Index:0

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x00x00x10000x7be2507.81330x6RW 0x2000
            LOAD0x00x7c00000x7c00000x1cde2d0x1cde2d7.99990x5R E0x2000
            GNU_STACK0x00x00x00x00x00.00000x6RW 0x10

            Network Behavior

            ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

            System Behavior

            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/tmp/xmrig.x86_64
            Arguments:/tmp/xmrig.x86_64
            File size:1892488 bytes
            MD5 hash:c203754b371925fbab487056978ad7a4

            File Activities

            Process Activities

            System Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/tmp/xmrig.x86_64
            Arguments:-
            File size:1892488 bytes
            MD5 hash:c203754b371925fbab487056978ad7a4

            Process Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:sh -c "crontab -l"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            File Activities

            Process Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Process Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/usr/bin/crontab
            Arguments:crontab -l
            File size:43720 bytes
            MD5 hash:66e521d421ac9b407699061bf21806f5

            File Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/tmp/xmrig.x86_64
            Arguments:-
            File size:1892488 bytes
            MD5 hash:c203754b371925fbab487056978ad7a4

            Process Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:sh -c "echo \"@reboot /tmp/xmrig.x86_64\" | crontab -"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            File Activities

            Process Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Process Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/usr/bin/crontab
            Arguments:crontab -
            File size:43720 bytes
            MD5 hash:66e521d421ac9b407699061bf21806f5

            File Activities


            General

            Start time:08:59:58
            Start date:29/08/2023
            Path:/tmp/xmrig.x86_64
            Arguments:-
            File size:1892488 bytes
            MD5 hash:c203754b371925fbab487056978ad7a4

            File Activities

            Process Activities

            System Activities


            General

            Start time:09:00:03
            Start date:29/08/2023
            Path:/tmp/xmrig.x86_64
            Arguments:-
            File size:1892488 bytes
            MD5 hash:c203754b371925fbab487056978ad7a4

            Process Activities


            General

            Start time:09:00:11
            Start date:29/08/2023
            Path:/tmp/xmrig.x86_64
            Arguments:-
            File size:1892488 bytes
            MD5 hash:c203754b371925fbab487056978ad7a4

            Process Activities


            General

            Start time:09:00:12
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:sh -c "/sbin/modprobe msr allow_writes=on > /dev/null 2>&1"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            File Activities

            Process Activities


            General

            Start time:09:00:13
            Start date:29/08/2023
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Process Activities


            General

            Start time:09:00:13
            Start date:29/08/2023
            Path:/sbin/modprobe
            Arguments:/sbin/modprobe msr allow_writes=on
            File size:174424 bytes
            MD5 hash:0b44462b1a40df8039d6d61cfff7ea84

            File Activities

            System Activities


            General

            Start time:09:01:21
            Start date:29/08/2023
            Path:/usr/bin/dash
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Process Activities


            General

            Start time:09:01:21
            Start date:29/08/2023
            Path:/usr/bin/rm
            Arguments:rm -f /tmp/tmp.2PtsmUDOSW /tmp/tmp.PjFhvnRwmF /tmp/tmp.3sRtdkblqA
            File size:72056 bytes
            MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

            File Activities