MALICIOUS — libxmrig-mo.so

MALICIOUS — libxmrig-mo.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (79/100), attributed to the RiskTool family. 3 of 53 detection engines flagged it.

Identification

• SHA-256: aae306433e32315661d8aa78bb61f2f4192be9ad39683d4642c88185cd4270f0
• SHA-1: 0df508e5824f9dfb9cbc2ccc77f9a11177a9bdc8
• MD5: 9f6260ea1d03bec81f0913ef636020b3
• ssdeep: 49152:xoTdN1ZMCU/WkiHM+bO2Bfk5HdtHkZb2acuwbQIlVKybk:xoTdieFpu9dtHkncuwbQAVKAk
• TLSH: T1EE619E311FA93026F63846C59CA0C97C1B8E722DCDEDDEED4AD60EA2409C95BAD341D1
• Submitted as: libxmrig-mo.so
• File type: elf · Size: 4084796 bytes
• Verdict: malicious (79/100) · Family: RiskTool

Detections (3 of 53 engines)

• YARA: Intezer community: INTEZER_Linux_XMRig_Miner
• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Linux.Miner.gen

Why this verdict

The malicious score of 79/100 is the fusion of 6 weighted signals:

• Kaspersky (KVRT) flagged not-a-virus:HEUR:RiskTool.Linux.Miner.gen (rule not-a-virus:HEUR:RiskTool.Linux.Miner.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://android.googlesource.com/toolchain/llvm-project, https://xmrig.com/wizard, https://xmrig.com/docs/algorithms - static signal, weight 0.35, confidence 0.60
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

866 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• ff02::16
• 255.255.255.255
• ff02::1:ff12:3456
• 185.125.190.56
• ff02::2
• ff02::1

Dropped files

• tmp_tmp.XbcPkhryWr - 03b72c44a887dc801b8e93006675cf78c1fb65267cf7fd9ff673ce97bc849887

Embedded URLs

• https://android.googlesource.com/toolchain/llvm-project
• https://xmrig.com/wizard
• https://xmrig.com/docs/algorithms

Embedded domains

• randomx.xmrig.com
• nicehash.com
• xmrig.com
• api.xmrig.com
• android.googlesource.com

More RiskTool samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report