26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T529,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Linux/CoinMiner.AV potentially unwanted application Sample 77d764ced0a7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 77d764ced0a7…. Malware family: Linux/CoinMiner.AV potentially unwanted application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8","keywords":["Malicious","Linux/CoinMiner.AV potentially unwanted application","malware analysis","sandbox report","threat intelligence","77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8"],"about":{"@type":"SoftwareApplication","name":"suspicious_mysql_binary","applicationCategory":["elf","64bits","executable"],"identifier":"77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Linux/CoinMiner.AV potentially unwanted application","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b9,Calls a syscall: "execve" Calls a syscall: "write" Calls a syscall: "mmap" Calls a syscall: "close" Calls a syscall: "open" Calls a syscall: "readlink" Calls a syscall: "munmap" Calls a syscall: "mprotect" Calls a syscall: "ftruncate" Calls a syscall: "msync" Calls a syscall: "brk" Calls a syscall: "arch_prctl" Calls a syscall: "set_tid_address" Calls a syscall: "set_robust_list" Calls a syscall: "uname" Calls a syscall: "getrandom" Calls a syscall: "openat" Calls a syscall: "read" Calls a syscall: "access" Calls a syscall: "fcntl" Calls a syscall: "newfstatat" Calls a syscall: "faccessat" Calls a syscall: "getdents64" Calls a syscall: "sched_getaffinity" Calls a syscall: "sched_setaffinity" Calls a syscall: "lseek" Calls a syscall: "rt_sigaction" Calls a syscall: "epoll_create1" Calls a syscall: "pipe" Calls a syscall: "eventfd" Calls a syscall: "rt_sigprocmask" Calls a syscall: "socket" Calls a syscall: "bind" Calls a syscall: "getsockname" Calls a syscall: "sendto" Calls a syscall: "recvmsg" Calls a syscall: "ioctl" Calls a syscall: "epoll_ctl" Calls a syscall: "clone3" Calls a syscall: "epoll_pwait" Calls a syscall: "setsockopt" Calls a syscall: "connect" Calls a syscall: "getsockopt" Calls a syscall: "wait4" Calls a syscall: "pread" Calls a syscall: "pwrite" Calls a syscall: "clone" Calls a syscall: "fstat" Calls a syscall: "stat" Calls a syscall: "exit_group" Calls a syscall: "procexit"28:T6df,/home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/online /home/ubuntu/suspicious_mysq reads file /proc/cmdline /home/ubuntu/suspicious_mysq reads file /proc/cpuinfo /home/ubuntu/suspicious_mysq reads file /proc/self/cpuset /home/ubuntu/suspicious_mysq reads file /sys/fs/cgroup/cpuset/cpuset.cpus /home/ubuntu/suspicious_mysq reads file /sys/fs/cgroup/cpuset/cpuset.mems /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/topology/core_cpus /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/topology/core_id /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/topology/die_cpus /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/topology/package_cpus /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/topology/physical_package_id /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/level /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/type /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/id /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/size /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition /home/ubuntu/suspicious_mysq reads file /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790333323729,"unified_at":"2026-09-25T10:48:43.729Z","metadata":{"hashes":{"sha256":"77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8","sha1":"9fae92dc0df2e8ac9e494f282c258c7fc918700a","md5":"590b00dff7a44130ebe1350a5b4ddc97","sha512":"52bfdcafa627d703f8f52e9b1c199d3aa3e5b10c4e64094531e66f8b0a26faf14f1ce45ce011f3ead33b3df7160d37ef1e7f88a0e8bf22f309b5af7a54b55ff0","ssdeep":"49152:sFm5NNUgn1A5JUMt6oE5/p7SEi3+/xQaSk25s3nvL7:sUvmMy5qUVkf3xQa52+3z7","ssdeep_chunks":["49152:sFm5NNU","49152:Fm5NNUg","49152:m5NNUgn","49152:5NNUgn1","49152:NNUgn1A","49152:NUgn1A5","49152:Ugn1A5J","49152:gn1A5JU","49152:n1A5JUM","49152:1A5JUMt","49152:A5JUMt6","49152:5JUMt6o","49152:JUMt6oE","49152:UMt6oE5","49152:Mt6oE5/","49152:t6oE5/p","49152:6oE5/p7","49152:oE5/p7S","49152:E5/p7SE","49152:5/p7SEi","49152:/p7SEi3","49152:p7SEi3+","49152:7SEi3+/","49152:SEi3+/x","49152:Ei3+/xQ","49152:i3+/xQa","49152:3+/xQaS","49152:+/xQaSk","49152:/xQaSk2","49152:xQaSk25","49152:QaSk25s","49152:aSk25s3","49152:Sk25s3n","49152:k25s3nv","49152:25s3nvL","49152:5s3nvL7","98304:sFm5NNU","98304:Fm5NNUg","98304:m5NNUgn","98304:5NNUgn1","98304:NNUgn1A","98304:NUgn1A5","98304:Ugn1A5J","98304:gn1A5JU","98304:n1A5JUM","98304:1A5JUMt","98304:A5JUMt6","98304:5JUMt6o","98304:JUMt6oE","98304:UMt6oE5","98304:Mt6oE5/","98304:t6oE5/p","98304:6oE5/p7","98304:oE5/p7S","98304:E5/p7SE","98304:5/p7SEi","98304:/p7SEi3","98304:p7SEi3+","98304:7SEi3+/","98304:SEi3+/x","98304:Ei3+/xQ","98304:i3+/xQa","98304:3+/xQaS","98304:+/xQaSk","98304:/xQaSk2","98304:xQaSk25","98304:QaSk25s","98304:aSk25s3","98304:Sk25s3n","98304:k25s3nv","98304:25s3nvL","98304:5s3nvL7","49152:sUvmMy5","49152:UvmMy5q","49152:vmMy5qU","49152:mMy5qUV","49152:My5qUVk","49152:y5qUVkf","49152:5qUVkf3","49152:qUVkf3x","49152:UVkf3xQ","49152:Vkf3xQa","49152:kf3xQa5","49152:f3xQa52","49152:3xQa52+","49152:xQa52+3","49152:Qa52+3z","49152:a52+3z7"],"imphash":"Unknown"},"file_info":{"file_name":"suspicious_mysql_binary","file_type":["elf","64bits","executable"],"file_type_id":"64-bit elf","file_size":2017428,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1769836498000,"last_seen":1773823603000,"last_multi_scan":1773823603000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","mineware","criminal","xmrig","evasive"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":17},"sandbox_signatures":{"informative_count":16,"suspicious_count":8,"malicious_count":6,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Linux/CoinMiner.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare/Linux.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Generic.4762197","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"linux/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Linux/CoinMiner.AV potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"E64/ABMiner.JNOM-3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Linux/CoinMiner.AV potentially unwanted application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Unix Shell","attack_id":"T1059.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/004","identifiers":[{"type":"informative","value":"Executes shell scripts"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls native functions (syscalls)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match – Anomalous ELF file structure"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"malicious","value":"The binary is stripped and also statically linked"},{"type":"suspicious","value":"Binary is statically linked"},{"type":"informative","value":"Binary is stripped"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"malicious","value":"Binary is packed"},{"type":"malicious","value":"Section headers are modified/stripped"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Calls a system call typically used to retrieve the current address to which the socket is bound"},{"type":"informative","value":"Retrieves the configured DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Queries system general information (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls a system call typically used to get directory entries"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Queries socket options"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads hosts file (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Modifies socket options"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"The process modifies itself (often used to modify name for evasion)"}],"sources":[{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9454","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"General","name":"Binary is stripped","description":"suspicious_mysql_binary is stripped","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-1000","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"92r2bRK\" (Indicator: \"brk\"; File: \"suspicious_mysql_binary\")\n Found reference to API \"tee}(lA\" (Indicator: \"tee\"; File: \"suspicious_mysql_binary\")\n Found reference to API \"READY\" (Indicator: \"read\"; File: \"suspicious_mysql_binary\")\n Found reference to API \"tEeKT\" (Indicator: \"tee\"; File: \"suspicious_mysql_binary\")\n Found reference to API \"sh -c /sbin/modprobe msr allow_writes=on > /dev/null 2>&1\" (Indicator: \"write\"; File: \"sh\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"General","name":"Executes shell scripts","description":"/home/ubuntu/suspicious_mysq executed: \"sh\" with commandline \"sh -c /sbin/modprobe msr allow_writes=on > /dev/null 2>&1\"","origin":"Monitored Target","mitre_attack_id":"T1059.004","relevance":3,"id":"target-5115","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fokoffkont.anondns.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 452703)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Network Related","name":"Calls a system call typically used to retrieve the current address to which the socket is bound","description":"/home/ubuntu/suspicious_mysq executed: getsockname","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1152","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"zy.gn\"\n Heuristic match: \"xi;.gm\"\n Heuristic match: \"szq!.nc\"\n Heuristic match: \"ua ].by\"\n Heuristic match: \"64.gb\"\n Heuristic match: \"ti*.ax\"\n Heuristic match: \"##.pe\"\n Heuristic match: \"(?k.nr\"\n Heuristic match: \"rx.bi\"\n Heuristic match: \":i.ad\"\n Heuristic match: \"9h.fj\"\n Heuristic match: \"fokoffkont.anondns.net\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Network Related","name":"Queries socket options","description":"/home/ubuntu/suspicious_mysq uses: getsockopt","origin":"API Call","mitre_attack_id":"T1049","id":"api-1007","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Anomalous ELF file structure","description":"YARA signature for invalid unusual section file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-558","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to get directory entries","description":"/home/ubuntu/suspicious_mysq executed: getdents64\n sh executed: getdents64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1153","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries system general information (syscall)","description":"/home/ubuntu/suspicious_mysq used: uname\n sh used: uname","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1006","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 359312)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/26 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"Network Related","name":"Reads hosts file (syscall)","description":"suspicious_mysq read: /etc/host.conf\n suspicious_mysq read: /etc/hosts","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-1028","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Binary is statically linked","description":"suspicious_mysql_binary is statically linked","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-1001","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Binary is packed","description":"suspicious_mysql_binary entropy is: 7.945396378811301","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-1003","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to discard command(s) output","description":"/home/ubuntu/suspicious_mysq executed: \"sh\" with commandline \"sh -c /sbin/modprobe msr allow_writes=on > /dev/null 2>&1\"","origin":"Monitored Target","relevance":10,"id":"target-5074","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"malicious","category":"Anti-Reverse Engineering","name":"Section headers are modified/stripped","description":"suspicious_mysql_binary section headers are modified/stripped","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-1004","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"malicious","category":"Anti-Reverse Engineering","name":"The binary is stripped and also statically linked","description":"The binary has been stripped of all debug symbols and its shared objects are also statically linked to the binary","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":10,"id":"summary-1000","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: linux/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"}]},{"level":"informative","category":"Network Related","name":"Retrieves the configured DNS server","description":"/home/ubuntu/pid_3174152_roo reads file /etc/resolv.conf","origin":"API Call","mitre_attack_id":"T1016","relevance":7,"id":"api-1199","sources":[{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"The process modifies itself (often used to modify name for evasion)","description":"/home/ubuntu/pid_3174152_roo modifies itself during the runtime with PRCTL","origin":"API Call","mitre_attack_id":"T1036","relevance":3,"id":"api-1001","sources":[{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"Network Related","name":"Modifies socket options","description":"/home/ubuntu/pid_3174152_roo uses: setsockopt","origin":"API Call","mitre_attack_id":"T1095","relevance":3,"id":"api-1008","sources":[{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"level":"suspicious","category":"Network Related","name":"Sends raw ethernet packets (often used by malware targeting embedded devices)","description":"/home/ubuntu/pid_3174152_roo sends raw packets through: :55006->127.0.0.53","origin":"API Call","relevance":10,"id":"api-1002","sources":[{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries system general information (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","mineware","criminal","xmrig","evasive"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"69ba667375f33e4ad90a45f9","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CoinMiner.Gen2","contacted_countries":["NLD"],"submit_name":"suspicious_mysql_binary","analysis_start_time":"2026-03-18T08:49:03+00:00","indicators_count":{"informative":15,"suspicious":6,"malicious":8},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true},{"id":"69ac1b3a1f7eae76b709d5bc","environment_id":330,"environment_description":"Linux (Ubuntu 24.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ABMiner.JNOM","contacted_countries":["NLD"],"submit_name":"pid_3174152_root_tmp_mysql_","analysis_start_time":"2026-03-07T12:42:56+00:00","indicators_count":{"informative":16,"suspicious":7,"malicious":7},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"fokoffkont.anondns.net","address":"5.255.106.100","ttl":59,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"69ba667375f33e4ad90a45f9"},{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ac1b3a1f7eae76b709d5bc"}],"processes":[{"pid":1816,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"1942437185-1816"},{"pid":1817,"ppid":1816,"name":"sh","command_line":"sh -c /sbin/modprobe msr allow_writes=on > /dev/null 2>&1","normalized_path":"sh","parent_uid":"1942437185-1816","uid":"1942444185-1817"},{"pid":1809,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"17929016174-1809"},{"pid":1810,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"17966956992-1810"},{"pid":1811,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"17967176993-1811"},{"pid":1812,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"17967396994-1812"},{"pid":1813,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"17967606994-1813"},{"pid":1814,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"17967836994-1814"},{"pid":1822,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"19671955213-1822"},{"pid":1823,"ppid":0,"name":"pid_3174152_roo","command_line":"","normalized_path":"/home/ubuntu/pid_3174152_roo","uid":"19672125213-1823"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69ba667375f33e4ad90a45f9","69ac1b3a1f7eae76b709d5bc"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Linux/CoinMiner.AV potentially unwanted application Sample 77d764ced0a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 77d764ced0a7…. Malware family: Linux/CoinMiner.AV potentially unwanted application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8"}],["$","meta","4",{"property":"og:title","content":"Malicious Linux/CoinMiner.AV potentially unwanted application Sample 77d764ced0a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 77d764ced0a7…. Malware family: Linux/CoinMiner.AV potentially unwanted application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/77d764ced0a7bcac8814aaa2a08a1d11762f3c702eb06b77b6388d3f279951a8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Linux/CoinMiner.AV potentially unwanted application Sample 77d764ced0a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 77d764ced0a7…. Malware family: Linux/CoinMiner.AV potentially unwanted application. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]