MALICIOUS — libxmrig-mo.so

MALICIOUS — libxmrig-mo.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the XMRig family. 4 of 53 detection engines flagged it.

Identification

• SHA-256: dd14ad90c2e34e200e0c01e95702ebce3441f42e92347e30203bb54d0e19f283
• SHA-1: 3a37afe37765fa730fefcbc7de70b394c655c740
• MD5: 755523662c0abe59ebc0592b9160f35f
• ssdeep: 98304:xFEUeAGcpxD5gNn7N2BE9m7H1Ws98JwaVK:sCHpl5gN4ByYWs9B
• TLSH: T19763ADC814A47C40E4EDAE28B1E92A7C95CA45CFC27916DDA9EB0841D1EBB3309F5C17
• Submitted as: libxmrig-mo.so
• File type: elf · Size: 4804496 bytes
• Verdict: malicious (89/100) · Family: XMRig

Detections (4 of 53 engines)

• YARA: Intezer community: INTEZER_Linux_XMRig_Miner
• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• Microsoft Defender: Trojan:Linux/CoinMiner.N!MTB
• Kaspersky (KVRT): not-a-virus:HEUR:RiskTool.Linux.Miner.gen

Why this verdict

The malicious score of 89/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:Linux/CoinMiner.N!MTB (rule Trojan:Linux/CoinMiner.N!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged not-a-virus:HEUR:RiskTool.Linux.Miner.gen (rule not-a-virus:HEUR:RiskTool.Linux.Miner.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://xmrig.com/docs/algorithms, https://android.googlesource.com/toolchain/llvm-project, https://xmrig.com/wizard - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

842 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• 10.240.0.1
• 185.125.190.58
• 91.189.91.157
• ff02::1:ff12:3456
• ff02::2
• ff02::16
• ff02::1
• 255.255.255.255

Dropped files

• tmp_tmp.W9OAeXwYUJ - a854238f85655166481a7c9c740dc700b3c298cc122aebabc1fab3a5ed3d6f96

Embedded URLs

• https://xmrig.com/docs/algorithms
• https://android.googlesource.com/toolchain/llvm-project
• https://xmrig.com/wizard

Embedded domains

• randomx.xmrig.com
• xmrig.com
• nicehash.com
• api.xmrig.com
• android.googlesource.com

More XMRig samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report