AI
XMRig cryptojacking malware payload
Local reference
Suspicious dependency
Inferred
Mal-ecule
K(Mc)O₃(Er₄I₂As)H₃(CrF₃Os)Md₅(ArBiBkHe)
ARM ELF embeds XMRig configuration beside hidden BusyBox staging paths: Mddos.arm5:0x12
ARM XMRig payload masquerades as a kworker thread: Mddos.arm5:0x12
Kernel worker CPU process name: Mddos.arm5:0xefc9
| 0x0 | 7f454c46010101610000000000000000 | .ELF...a........ |
| 0x10 | 02002800010000009081000034000000 | ..(.........4...ARM XMRig payload masquerades as a kworker thread |
| 0x20 | 88020100020000003400200003002800 | ........4. ...(. |
| 0x30 | 0a000900010000000000000000800000 | ................ |
| 0x40 | 0080000084fb000084fb000005000000 | ................ |
| 0x50 | 00800000010000000000010000800100 | ................ |
| 0x60 | 0080010048020000400a000006000000 | ....H...@....... |
| 0x70 | 0080000051e574640000000000000000 | ....Q.td........ |
| 0x80 | 00000000000000000000000007000000 | ................ |
| 0x90 | 040000000dc0a0e1f0df2de904b04ce2 | ..........-...L. |
| 0xa0 | 220000ebe63a00ebf0af1be900000000 | "....:.......... |
| 0xb0 | 30402de95c509fe50030d5e5000053e3 | 0@-.\P...0....S. |
| 0xc0 | 3080bd1850409fe5003094e5002093e5 | 0...P@...0... .. |
| 0xd0 | 000052e30700000a043083e2003084e5 | ..R......0...0.. |
| 0xe0 | 0fe0a0e102f0a0e1003094e5002093e5 | .........0... .. |
| 0xf0 | 000052e3f7ffff1a20309fe5000053e3 | ..R..... 0....S. |
| 0x100 | 1c009f150fe0a01103f0a0110130a0e3 | .............0.. |
| 0x110 | 0030c5e53080bd | .0..0.. |
| 0xee00 | 7275652c0a0000002020202020202020 | rue,.... |
| 0xee10 | 22687567652d7061676573223a207472 | "huge-pages": tr |
| 0xee20 | 75652c0a000000002020202020202020 | ue,..... |
| 0xee30 | 227072696f72697479223a20352c0a00 | "priority": 5,.. |
| 0xee40 | 2020202020202020226d61782d746872 | "max-thr |
| 0xee50 | 656164732d68696e74223a2000000000 | eads-hint": .... |
| 0xee60 | 20202020202020202261736d223a2074 | "asm": t |
| 0xee70 | 7275650a00000000202020207d2c0a00 | rue..... },.. |
| 0xee80 | 2020202022706f6f6c73223a205b7b0a | "pools": [{.ARM ELF embeds XMRig configuration beside hidden BusyBox staging paths |
| 0xee90 | 0000000020202020202020202275726c | .... "url |
| 0xeea0 | 223a202200000000222c0a0020202020 | ": "....",.. |
| 0xeeb0 | 202020202275736572223a2022000000 | "user": "... |
| 0xeec0 | 20202020202020202270617373223a20 | "pass": |
| 0xeed0 | 220000002020202020202020226b6565 | "... "kee |
| 0xeee0 | 70616c697665223a20747275652c0a00 | palive": true,.. |
| 0xeef0 | 202020202020202022746c73223a2074 | "tls": t |
| 0xef00 | 7275650a00000000202020207d5d2c0a | rue..... }],. |
| 0xef10 | 000000002020202022646f6e6174652d | .... "donate-ARM XMRig payload masquerades as a kworker thread |
| 0xef20 | 6c6576656c223a20300a00007d0a0000 | level": 0...}... |
| 0xef30 | 2f7661722f746d702f2e63726f6e6400 | /var/tmp/.crond. |
| 0xef40 | 687474703a2f2f002f4d64646f732f78 | http://./Mddos/xXMRig miner reference |
| 0xef50 | 6d7269672e00000061726d76356c0000 | mrig....armv5l.. |
| 0xef60 | 2f62696e2f62757379626f7800000000 | /bin/busybox.... |
| 0xef70 | 77676574000000002d7100002d4f0000 | wget....-q..-O.. |
| 0xef80 | 2f6465762f6e756c6c0000002f757372 | /dev/null.../usr |
| 0xef90 | 2f62696e2f776765740000002f737973 | /bin/wget.../sys |
| 0xefa0 | 74656d2f62696e2f6375726c00000000 | tem/bin/curl.... |
| 0xefb0 | 2d7300002d6f00002f7573722f62696e | -s..-o../usr/bin |
| 0xefc0 | 2f6375726c0000005b6b776f726b6572 | /curl...[kworkerKernel worker CPU process name |
| 0xefd0 | 2f303a305d0000002f70726f632f7374 | /0:0].../proc/st |
| 0xefe0 | 617400002f746d702f2e786d7269672e | at../tmp/.xmrig. |
| 0xeff0 | 6c6f670073706565640000002f766172 | log.speed.../var |
| 0xf000 | 2f746d702f2e7379736c6f6764000000 | /tmp/.syslogd... |
| 0xf010 | 780000002d6300002d2d646f6e617465 | x...-c..--donate |
| 0xf020 | 2d6c6576656c000030000000306f0100 | -level..0...0o.. |
| 0xf030 | 14700100fc6f01001870010028700100 | .p...o...p..(p.. |
| 0xf040 | 00000000474554202f00000020485454 | ....GET /... HTT |
| 0xf050 | 502f312e310d0a486f73743a20000000 | P/1.1..Host: ... |
| 0xf060 | 2e636f6d0d0a0000557365722d416765 | .com....User-Age |
| 0xf070 | 6e743a204d6f7a696c6c612f352e300d | nt: Mozilla/5.0. |
| 0xf080 | 0a0000004163636570743a202a2f2a0d | ....Accept: */*. |
| 0xf090 | 0a000000436f6e6e656374696f6e3a20 | ....Connection: |
| 0xf0a0 | 6b6565702d616c6976650d0a00000000 | keep-alive...... |
| 0xf0b0 | 582d613a20620d0a0000000061000000 | X-a: b......a... |
| 0xf0c0 | 00000001000000007151715a65606a6c | ........qQqZe`jl |
| 0xf0d0 | 715171715f4c4e48270900005e6c296e | qQqq_LNH'...^l)n |
| 0xf0e0 | 667d297d61607a297a61607d2968657b | f})}a`z)za`})he{ |
| 0xf0f0 | 6c686d70270900007e7e7e276b686663 | lhmp'...~~~'khfc |
Well-known
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
build
ELF omits compiler metadata (.comment)
Identity
| SHA-256 | 515835c80bea56fd93b27658f00c5ad8b642a4f5610ded46c85ce3fd141b3f37 |
|---|---|
| Filename | Mddos.arm5 |
| Package | 515835c80bea56fd93b27658f00c5ad8b642a4f5610ded46c85ce3fd141b3f37 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | linux |
| Domain | abuse.ch |
Timeline
| First seen | 2 Aug 2026 10:10 UTC |
|---|---|
| First analyzed | 4 Aug 2026 02:06 UTC |
| Last analyzed | 4 Aug 2026 02:06 UTC |
| Last updated | 4 Aug 2026 02:06 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 95b20 |
Not seeing what you expected? Let us know