MALICIOUS — libxmrig.so

MALICIOUS — libxmrig.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100), attributed to the RiskTool family. 2 of 53 detection engines flagged it.

Identification

• SHA-256: dcb1fafec3748ee1d82605cc54c8c53ce6595b0413b7433dc781402da01080cb
• SHA-1: df863fd897aba3a1915d1598d03d644f48aba5f6
• MD5: 3cc7b6e51350cebc683ec4842f0e01c1
• ssdeep: 49152:eMXHQjNHJoPKtrDLpuCaiGNdbbeVQjSdhSuxA:eMXwjNmPKtrHpuCaiqbbe+ux
• TLSH: T15F5B8E8C54387C85E8E4E53CF9913A2C758288CA957A1ACD6DE385C2F1A7F330574A63
• Submitted as: libxmrig.so
• File type: elf · Size: 2364696 bytes
• Verdict: malicious (72/100) · Family: RiskTool

Detections (2 of 53 engines)

• YARA: Intezer community: INTEZER_Linux_XMRig_Miner
• Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Linux.Miner.gen

Why this verdict

The malicious score of 72/100 is the fusion of 5 weighted signals:

• Kaspersky (KVRT) flagged not-a-virus:HEUR:RiskTool.Linux.Miner.gen (rule not-a-virus:HEUR:RiskTool.Linux.Miner.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://android.googlesource.com/toolchain/llvm-project, https://xmrig.com/docs/algorithms, https://xmrig.com/wizard - static signal, weight 0.35, confidence 0.60
• Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

843 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• 185.125.190.58
• ff02::16
• ff02::2
• ff02::1:ff12:3456
• ff02::1
• 255.255.255.255

Dropped files

• tmp_tmp.LEstH6xlEX - 011dc76f87104b55783cae125874b739e4df229afd937e1ceb04df840706ba00

Embedded URLs

• https://android.googlesource.com/toolchain/llvm-project
• https://xmrig.com/docs/algorithms
• https://xmrig.com/wizard

Embedded domains

• nicehash.com
• ghostrider.mine.zpool.ca
• ghostrider.unmineable.com
• xmrig.com
• android.googlesource.com

More RiskTool samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report