MALICIOUS — xmrig_arm64

MALICIOUS — xmrig_arm64 is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100), attributed to the RiskTool family. 2 of 53 detection engines flagged it.

Identification

• SHA-256: a847b257cc6b29cda5e7e485bccbe1ba8e1d573d22f74731f15497ba7b576c4a
• SHA-1: c4a14a80eb8e465f029bc34cc5aef6bae6f52f61
• MD5: a0da766f9bc4c0bedc1fc77b266fdcdd
• ssdeep: 98304:AhMcHfHBT3K3W66IGC18bJUVZfeoxJNhEkx0Oy/tJfrNkC7Ov/cOhoQZd:gMYlK0IGfUVcuttGjNMv
• TLSH: T167709EE12A76B4D9E9F553067C98E19F3DD3A4382876063C53806643C6D7E73A13222B
• Submitted as: xmrig_arm64
• File type: elf · Size: 16876168 bytes
• Verdict: malicious (72/100) · Family: RiskTool

Detections (2 of 53 engines)

• YARA: Intezer community: INTEZER_Linux_XMRig_Miner
• Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Linux.Miner.gen

Why this verdict

The malicious score of 72/100 is the fusion of 5 weighted signals:

• Kaspersky (KVRT) flagged not-a-virus:HEUR:RiskTool.Linux.Miner.gen (rule not-a-virus:HEUR:RiskTool.Linux.Miner.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://xmrig.com/docs/algorithms, https://xmrig.com/wizard, https://android.googlesource.com/toolchain/llvm-project - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

865 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• ff02::2
• 255.255.255.255
• ff02::1:ff12:3456
• ff02::16
• ff02::1
• 185.125.190.58
• 185.125.190.56

Dropped files

• tmp_tmp.QSPjje6W05 - ce9f512ced333849803ecd3dcd913ceaad73c5758dbb4090340c3e1a352fbccd

Embedded URLs

• https://xmrig.com/docs/algorithms
• https://xmrig.com/wizard
• https://android.googlesource.com/toolchain/llvm-project

Embedded domains

• nicehash.com
• donate.v2.xmrig.com
• api.xmrig.com
• donate.ssl.xmrig.com
• xmrig.com
• randomx.xmrig.com
• format.cc
• android.googlesource.com

File paths

• u:\ua

More RiskTool samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report