Joe Sandbox Cloud Basic Analysis Report
Edit tour

Linux Analysis Report
xmrig.i686

Overview

General Information

Sample Name:xmrig.i686
Analysis ID:1300720
MD5:3374fc49e430ab5b790f1cf560596bc6
SHA1:dae1576cdd85ceb7d91afd1298d10a2a054ffecc
SHA256:79d27aa48a8ac30713cf20c35301293ee8455d2cffc2db1510ea4541176a8f0a
Infos:

Detection

Xmrig
Score:88
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
Executes the "crontab" command typically for achieving persistence
Sample is packed with UPX
Found strings related to Crypto-Mining
Tries to read the SSH 'known_hosts' file
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Sample contains only a LOAD segment without any section mappings
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Reads system information from the proc file system
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Reads CPU information from /proc indicative of miner or evasive malware
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox Version:38.0.0 Beryl
Analysis ID:1300720
Start date and time:2023-08-30 23:43:28 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 30s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:xmrig.i686
Detection:MAL
Classification:mal88.troj.evad.mine.linI686@0/3@0/0
  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: xmrig.i686

Runtime Messages

Command:/tmp/xmrig.i686
PID:6227
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:

Standard Error:no crontab for root

Process Tree

  • system is lnxubuntu20
  • xmrig.i686 (PID: 6227, Parent: 6122, MD5: 3374fc49e430ab5b790f1cf560596bc6) Arguments: /tmp/xmrig.i686
    • sh (PID: 6228, Parent: 6227, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab -l"
      • sh New Fork (PID: 6231, Parent: 6228)
      • crontab (PID: 6231, Parent: 6228, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l
    • sh (PID: 6233, Parent: 6227, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"@reboot /tmp/xmrig.i686\" | crontab -"
      • sh New Fork (PID: 6234, Parent: 6233)
      • sh New Fork (PID: 6235, Parent: 6233)
      • crontab (PID: 6235, Parent: 6233, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -
  • cleanup

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpLinux_Cryptominer_Camelot_b8552fffunknownunknown
    • 0xb3d12:$a: 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74
    • 0xb3d42:$a: 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74
    • 0xb3d72:$a: 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74
    • 0xb3da2:$a: 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74
    6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpLinux_Hacktool_Bruteforce_eb83b6aaunknownunknown
    • 0x241cc1:$a: 10 89 45 EC EB 04 83 6D EC 01 83 7D EC 00 74 12 8B 45 EC 8D
    • 0x249eb1:$a: 10 89 45 EC EB 04 83 6D EC 01 83 7D EC 00 74 12 8B 45 EC 8D
    Process Memory Space: xmrig.i686 PID: 6227JoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      • • AV Detection
      • • Bitcoin Miner
      • • Networking
      • • System Summary
      • • Data Obfuscation
      • • Persistence and Installation Behavior
      • • Hooking and other Techniques for Hiding and Protection
      • • Malware Analysis System Evasion
      • • Stealing of Sensitive Information

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: xmrig.i686ReversingLabs: Detection: 37%

      Bitcoin Miner

      barindex
      Source: Yara matchFile source: 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: xmrig.i686 PID: 6227, type: MEMORYSTR
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: stratum+ssl://randomx.xmrig.com:443
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: cryptonight/0
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: -o, --url=URL URL of mining server
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: stratum+tcp://
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/possibleJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: http://download.asyncfox.xyz/download/xmrig.i686;
      Source: xmrig.i686String found in binary or memory: http://upx.sf.net
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: https://gcc.gnu.org/bugs/):
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: https://xmrig.com/benchmark/%s
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: https://xmrig.com/docs/algorithms
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: https://xmrig.com/wizard
      Source: xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpString found in binary or memory: https://xmrig.com/wizard%s

      System Summary

      barindex
      Source: 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmp, type: MEMORYMatched rule: Linux_Cryptominer_Camelot_b8552fff Author: unknown
      Source: 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Bruteforce_eb83b6aa Author: unknown
      Source: LOAD without section mappingsProgram segment: 0x0
      Source: 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmp, type: MEMORYMatched rule: Linux_Cryptominer_Camelot_b8552fff reference_sample = cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Cryptominer.Camelot, fingerprint = d5998e0bf7df96dd21d404658589fb37b405398bd3585275419169b30c72ce62, id = b8552fff-29a9-4e09-810a-b4b52a7a3fb4, last_modified = 2021-09-16
      Source: 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmp, type: MEMORYMatched rule: Linux_Hacktool_Bruteforce_eb83b6aa reference_sample = 8dec88576f61f37fbaece3c30e71d338c340c8fb9c231f9d7b1c32510d2c3167, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Hacktool.Bruteforce, fingerprint = 7767bf57c57d398f27646f5ae2bcda07d6c62959becb31a5186ff0b027ff02b4, id = eb83b6aa-d7b5-4d10-9258-4bf619fc6582, last_modified = 2021-09-16
      Source: classification engineClassification label: mal88.troj.evad.mine.linI686@0/3@0/0

      Data Obfuscation

      barindex
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 4.02 Copyright (C) 1996-2023 the UPX Team. All Rights Reserved. $

      Persistence and Installation Behavior

      barindex
      Source: /bin/sh (PID: 6231)Crontab executable: /usr/bin/crontab -> crontab -lJump to behavior
      Source: /bin/sh (PID: 6235)Crontab executable: /usr/bin/crontab -> crontab -Jump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)File: /proc/6227/mountsJump to behavior
      Source: /usr/bin/crontab (PID: 6235)File: /var/spool/cron/crontabs/tmp.J3S35FJump to behavior
      Source: /usr/bin/crontab (PID: 6235)File: /var/spool/cron/crontabs/rootJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads from proc file: /proc/cpuinfoJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads from proc file: /proc/meminfoJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)Reads from proc file: /proc/meminfoJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1582/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/3088/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/230/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/110/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/231/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/111/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/232/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1579/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/112/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/233/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1699/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/113/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/234/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1335/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1698/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/114/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/235/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1334/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1576/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/2302/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/115/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/236/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/116/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/237/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/117/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/118/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/910/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/119/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/912/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/10/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/2307/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/11/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/918/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/12/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/13/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/14/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/15/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/16/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/17/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/18/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1594/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/120/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/121/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1349/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/122/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/243/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/123/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/2/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/124/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/3/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/4/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/125/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/126/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1344/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1465/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1586/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/127/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/6/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/248/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/128/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/249/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1463/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/800/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/9/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/801/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/20/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/21/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1900/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/22/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/23/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/24/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/25/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/26/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/27/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/28/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/29/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/491/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/250/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/130/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/251/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/252/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/132/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/253/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/254/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/255/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/256/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1599/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/257/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1477/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/379/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/258/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1476/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/259/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1475/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/936/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/30/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/2208/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/35/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1809/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/6147/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/1494/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/260/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/261/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)File opened: /proc/141/mapsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6228)Shell command executed: sh -c "crontab -l"Jump to behavior
      Source: /tmp/xmrig.i686 (PID: 6233)Shell command executed: sh -c "echo \"@reboot /tmp/xmrig.i686\" | crontab -"Jump to behavior
      Source: submitted sampleStderr: no crontab for root: exit code = 0
      Source: xmrig.i686Submission file: segment LOAD with 7.89 entropy (max. 8.0)
      Source: xmrig.i686Submission file: segment LOAD with 7.9999 entropy (max. 8.0)
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpusJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_mapJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/levelJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/typeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/idJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_sizeJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_setsJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partitionJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from /sys: /sys/devices/system/cpu/possibleJump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Queries kernel information via 'uname': Jump to behavior
      Source: /tmp/xmrig.i686 (PID: 6236)Queries kernel information via 'uname': Jump to behavior
      Source: /tmp/xmrig.i686 (PID: 6227)Reads CPU info from proc file: /proc/cpuinfoJump to behavior
      Source: xmrig.i686, 6227.1.00000000f7fba000.00000000f7fbb000.rw-.sdmpBinary or memory string: VMware Virtual Platform
      Source: xmrig.i686, 6227.1.00000000f7d79000.00000000f7dc2000.rw-.sdmpBinary or memory string: vmwareP
      Source: xmrig.i686, 6227.1.00000000f7d79000.00000000f7dc2000.rw-.sdmpBinary or memory string: vmware
      Source: xmrig.i686, 6227.1.00000000f7d79000.00000000f7dc2000.rw-.sdmpBinary or memory string: qemuH
      Source: xmrig.i686, 6227.1.00000000f7d79000.00000000f7dc2000.rw-.sdmpBinary or memory string: qemu0

      Stealing of Sensitive Information

      barindex
      Source: /tmp/xmrig.i686 (PID: 6236)SSH known_hosts: /root/.ssh/known_hostsJump to behavior

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts1
      Scheduled Task/Job      		1
      Scheduled Task/Job      		1
      Scheduled Task/Job      		1
      Scripting      		1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default Accounts1
      Scripting      		1
      At (Linux)      		1
      At (Linux)      		11
      Obfuscated Files or Information      		LSASS Memory1
      File and Directory Discovery      		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain Accounts1
      At (Linux)      		Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager3
      System Information Discovery      		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS1
      Remote System Discovery      		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1300720 Sample: xmrig.i686 Startdate: 30/08/2023 Architecture: LINUX Score: 88 29 Malicious sample detected (through community Yara rule) 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected Xmrig cryptocurrency miner 2->33 35 Sample is packed with UPX 2->35 7 xmrig.i686 2->7         started        process3 signatures4 41 Found strings related to Crypto-Mining 7->41 43 Sample reads /proc/mounts (often used for finding a writable filesystem) 7->43 10 xmrig.i686 sh 7->10         started        12 xmrig.i686 sh 7->12         started        14 xmrig.i686 7->14         started        process5 signatures6 17 sh crontab 10->17         started        21 sh 10->21         started        23 sh crontab 12->23         started        45 Tries to read the SSH 'known_hosts' file 14->45 25 xmrig.i686 14->25         started        process7 file8 27 /var/spool/cron/crontabs/tmp.J3S35F, ASCII 17->27 dropped 37 Sample tries to persist itself using cron 17->37 39 Executes the "crontab" command typically for achieving persistence 17->39 signatures9

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      xmrig.i68638%ReversingLabsLinux.Hacktool.Multiverze

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      https://xmrig.com/benchmark/%s0%URL Reputationsafe
      https://xmrig.com/wizard0%URL Reputationsafe
      https://xmrig.com/wizard%s0%URL Reputationsafe
      https://xmrig.com/docs/algorithms0%URL Reputationsafe
      http://download.asyncfox.xyz/download/xmrig.i686;100%Avira URL Cloudmalware

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info
      NameSourceMaliciousAntivirus DetectionReputation
      http://download.asyncfox.xyz/download/xmrig.i686;xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpfalse
      • Avira URL Cloud: malware
      		unknown
      https://gcc.gnu.org/bugs/):xmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpfalse
        		high
        http://upx.sf.netxmrig.i686false
          		high
          https://xmrig.com/benchmark/%sxmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://xmrig.com/wizardxmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://xmrig.com/wizard%sxmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpfalse
          • URL Reputation: safe
          		unknown
          https://xmrig.com/docs/algorithmsxmrig.i686, 6227.1.00000000f7742000.00000000f7d78000.r-x.sdmpfalse
          • URL Reputation: safe
          		unknown

          World Map of Contacted IPs

          ⊘No contacted IP infos

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          Process:/tmp/xmrig.i686
          File Type:very short file (no magic)
          Category:dropped
          Size (bytes):1
          Entropy (8bit):0.0
          Encrypted:false
          SSDEEP:3:W:W
          MD5:ECCBC87E4B5CE2FE28308FD9F2A7BAF3
          SHA1:77DE68DAECD823BABBB58EDB1C8E14D7106E83BB
          SHA-256:4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
          SHA-512:3BAFBF08882A2D10133093A1B8433F50563B93C14ACD05B79028EB1D12799027241450980651994501423A66C276AE26C43B739BC65C4E16B10C3AF6C202AEBB
          Malicious:false
          Reputation:high, very likely benign file
          Preview:3
          Process:/tmp/xmrig.i686
          File Type:ASCII text, with no line terminators
          Category:dropped
          Size (bytes):4
          Entropy (8bit):1.5
          Encrypted:false
          SSDEEP:3:MRV:Mz
          MD5:537D9B6C927223C796CAC288CCED29DF
          SHA1:EA10E810F96FCA6858E37FDA9832ACE147EED87C
          SHA-256:0D21AE129A64E1D19E4A94DFCA3A67C777E17374E9D4CA2F74B65647A88119EA
          SHA-512:6D4B04576201F789368F251EA231F5D2C0AE4CF17E95851D3AE10A1825724502732289F830E06247465F0284D4E33A9A120F6D730E62483515556DC1FD9CD120
          Malicious:false
          Reputation:moderate, very likely benign file
          Preview:1040
          Process:/usr/bin/crontab
          File Type:ASCII text
          Category:dropped
          Size (bytes):199
          Entropy (8bit):5.188010954995461
          Encrypted:false
          SSDEEP:6:SUrpqoqQjEOP1KmREJOBFQ5Z5wk0upGMQ5UYLtCFt3HYjXXMl:8QjHig89wk0uxeHLUHYrO
          MD5:EE388771247EB4EBD0AA8BEB73F90213
          SHA1:434E11D4DE2E94C293521CDFC87E53455F1B2E3B
          SHA-256:4B02778CA865B1FC8DDFF2717C70A3F08125D742F1E1E018114810C3BB4C9799
          SHA-512:FBF750A0E7E0E61EB2A495D785629974FFC9C7427AD16091308FB68EAC7BCF18064794EA4B67A71663990F852AB6FA4A6B49352E20C54353ED065B734410782F
          Malicious:true
          Reputation:low
          Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (- installed on Wed Aug 30 23:44:12 2023).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@reboot /tmp/xmrig.i686.

          Static File Info

          General

          File type:ELF 32-bit LSB shared object, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
          Entropy (8bit):7.99987942864158
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:xmrig.i686
          File size:2'099'052 bytes
          MD5:3374fc49e430ab5b790f1cf560596bc6
          SHA1:dae1576cdd85ceb7d91afd1298d10a2a054ffecc
          SHA256:79d27aa48a8ac30713cf20c35301293ee8455d2cffc2db1510ea4541176a8f0a
          SHA512:35402aac7771e9b15cc05b36e91ded80157efe2f37f0039c22c1c885e792887d0398535951e761c2586ae86cd082cbda9bf869c4629e0fcd8bc29a91a2663ccd
          SSDEEP:49152:gOWbEBqdO32WN9lBflCqwTLGqEi5aKMpeI30QzyJaEJUzH:2bYXJlqlcz8IERezH
          TLSH:92A5339A72C54000FD531D73BACBB8320AB7F52EB58E0FA81EEA601D4975CA758456F3
          File Content Preview:.ELF....................h...4...........4. ...............................g...................h...h... ... .........Q.td............................E..yUPX!.........:e..:e.T...........<..?.E.`...X..)..._..}F....K6/....Q............\n...e...N!q.......k...g

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, little endian
          Version:1 (current)
          Machine:Intel 80386
          Version Number:0x1
          Type:DYN (Shared object file)
          OS/ABI:UNIX - Linux
          ABI Version:0
          Entry Point Address:0x87f268
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:0
          Section Header Size:0
          Number of Section Headers:0
          Header String Table Index:0

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x00x00x10000x67fc087.89000x6RW 0x1000
          LOAD0x00x6800000x6800000x2005150x2005157.99990x5R E0x1000
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x10

          Network Behavior

          ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

          System Behavior

          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/tmp/xmrig.i686
          Arguments:/tmp/xmrig.i686
          File size:2099052 bytes
          MD5 hash:3374fc49e430ab5b790f1cf560596bc6

          File Activities

          Process Activities

          System Activities


          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/tmp/xmrig.i686
          Arguments:-
          File size:2099052 bytes
          MD5 hash:3374fc49e430ab5b790f1cf560596bc6

          Process Activities


          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/bin/sh
          Arguments:sh -c "crontab -l"
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          File Activities

          Process Activities


          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/bin/sh
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Process Activities


          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/usr/bin/crontab
          Arguments:crontab -l
          File size:43720 bytes
          MD5 hash:66e521d421ac9b407699061bf21806f5

          File Activities


          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/tmp/xmrig.i686
          Arguments:-
          File size:2099052 bytes
          MD5 hash:3374fc49e430ab5b790f1cf560596bc6

          Process Activities


          General

          Start time:23:44:11
          Start date:30/08/2023
          Path:/bin/sh
          Arguments:sh -c "echo \"@reboot /tmp/xmrig.i686\" | crontab -"
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          File Activities

          Process Activities


          General

          Start time:23:44:12
          Start date:30/08/2023
          Path:/bin/sh
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          General

          Start time:23:44:12
          Start date:30/08/2023
          Path:/bin/sh
          Arguments:-
          File size:129816 bytes
          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

          Process Activities


          General

          Start time:23:44:12
          Start date:30/08/2023
          Path:/usr/bin/crontab
          Arguments:crontab -
          File size:43720 bytes
          MD5 hash:66e521d421ac9b407699061bf21806f5

          File Activities


          General

          Start time:23:44:12
          Start date:30/08/2023
          Path:/tmp/xmrig.i686
          Arguments:-
          File size:2099052 bytes
          MD5 hash:3374fc49e430ab5b790f1cf560596bc6

          File Activities

          Process Activities

          System Activities


          General

          Start time:23:44:16
          Start date:30/08/2023
          Path:/tmp/xmrig.i686
          Arguments:-
          File size:2099052 bytes
          MD5 hash:3374fc49e430ab5b790f1cf560596bc6

          Process Activities