MALICIOUS — libxmrig.so

MALICIOUS — libxmrig.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100), attributed to the RiskTool family. 2 of 53 detection engines flagged it.

Identification

• SHA-256: 01adba7c06026778e46910fd5f92fe8360e285bd765a904bb1c7fb16ce1e839a
• SHA-1: 076ac471aa7be963ef60504733f11bf9348b311e
• MD5: 11175cb04154d248d62627baf03e6dde
• ssdeep: 24576:l01qqBJqk8jEkxhV1YgXtm0dsZGngI+zuhh:l0cbT3hVN7X
• TLSH: T1B759F2BB4AE82423C0FF3754959749EE0259F1D9E1F539E268C9734314A422BFC342A6
• Submitted as: libxmrig.so
• File type: elf · Size: 1815508 bytes
• Verdict: malicious (72/100) · Family: RiskTool

Detections (2 of 53 engines)

• YARA: Intezer community: INTEZER_Linux_XMRig_Miner
• Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Linux.Miner.gen

Why this verdict

The malicious score of 72/100 is the fusion of 5 weighted signals:

• Kaspersky (KVRT) flagged not-a-virus:HEUR:RiskTool.Linux.Miner.gen (rule not-a-virus:HEUR:RiskTool.Linux.Miner.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://android.googlesource.com/toolchain/llvm-project, https://xmrig.com/docs/algorithms, https://xmrig.com/wizard - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

1490 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• 185.125.190.58
• 185.125.190.57
• ff02::1:ff12:3456
• ff02::1
• ff02::2
• ff02::16
• 255.255.255.255

Dropped files

• tmp_tmp.F5bLdxVzcu - 6fa1e4c81357d0165dce95719fe80e0d83273317fa87fea4b35fa9804cd7757f

Embedded URLs

• https://android.googlesource.com/toolchain/llvm-project
• https://xmrig.com/docs/algorithms
• https://xmrig.com/wizard

Embedded domains

• nicehash.com
• ghostrider.mine.zpool.ca
• ghostrider.unmineable.com
• xmrig.com
• h.fi
• android.googlesource.com

More RiskTool samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report