xmrig | 6696106489315328[.]zip

Sharing

Target

6696106489315328.zip
Size

19.7MB
MD5

85469f32cca835a9b58c26fec7280d1f
SHA1

c21bec402eb0664a913d9f705166ed1be6bb9aa5
SHA256

ab008ebf48d745343ceb220831f7c90dbc9bb75df422100cb8a60d57de13a1bb
SHA512

ecea0f8ef623c4964385a1ff9fa51920ace422b4ba0c660f64d6a22dd270e8ff93e3fd64570974179d8d760e6cacbef03adfe72340343ce96ab9e21a867703eb

Score

10^/10

Detected SUNBURST backdoor 2 IoCs

SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

Processes:

resource	yara_rule
static1/unpack001/16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7	family_sunburst
static1/unpack001/971b2ad87ced696d68e9476f746735096bf22656331b7bdf3b3f325c2ae1950a	family_sunburst

XMRig Miner Payload 4 IoCs

miner

Processes:

resource	yara_rule
static1/unpack001/03e7aaf552592613cd509fcb822068748e42eb876be969565c1d405b073ccbbb	xmrig
static1/unpack001/16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7	xmrig
static1/unpack001/971b2ad87ced696d68e9476f746735096bf22656331b7bdf3b3f325c2ae1950a	xmrig
static1/unpack001/9ccf017ae49bab69354c3d0c4625b0286450b637c8d71dc1aec1022fc576b532	xmrig

6696106489315328.zip
.zip

Password: infected
03e7aaf552592613cd509fcb822068748e42eb876be969565c1d405b073ccbbb
.dll windows x86
16b04fe2674ddd0fa8722fbd69a1b37620c69385ba9e3811faa3b66734c2fab7
.dll windows x86
2c4b454fe37acdb7c23d75924d4ffcda2943c0622d9d371c5c70717a242499d6
.dll windows x86
6ba6d85cc30a01fca2719e0a11fa6c44c850c4c6bf8d57d30e5ed3665937aead
.dll windows x86
80e8788a7fc1925d62517ee3f0c7d161a5bb89a8e93f22d007e4c1203952c905
.dll windows x86
971b2ad87ced696d68e9476f746735096bf22656331b7bdf3b3f325c2ae1950a
.dll windows x86
9ccf017ae49bab69354c3d0c4625b0286450b637c8d71dc1aec1022fc576b532
.dll windows x86
cb0cbf5026d0221243179a81580df6d35347ed381a2e1ac002bec6bc3f500b80
.dll windows x86
ebd5039cce22ae8a299533fe2350fc170763e7a7fe3c315ca417865ab086a019
.dll windows x86
f2a42097966b356234e73bd49c3e3eaa0a389809383549d92f7172a98211d3fc
.dll windows x86