Overview

overview

10

Static

static

3

grhsghsGHs...y8.exe

windows7-x64

10

grhsghsGHs...y8.exe

windows10-2004-x64

10

grhsghsGHs...SE.exe

windows7-x64

10

grhsghsGHs...SE.exe

windows10-2004-x64

10

grhsghsGHs...CD.exe

windows7-x64

10

grhsghsGHs...CD.exe

windows10-2004-x64

10

grhsghsGHs...Da.exe

windows7-x64

10

grhsghsGHs...Da.exe

windows10-2004-x64

10

grhsghsGHs...wq.exe

windows7-x64

10

grhsghsGHs...wq.exe

windows10-2004-x64

10

grhsghsGHs...r7.exe

windows7-x64

10

grhsghsGHs...r7.exe

windows10-2004-x64

10

grhsghsGHs...XJ.exe

windows7-x64

10

grhsghsGHs...XJ.exe

windows10-2004-x64

10

grhsghsGHs...eg.exe

windows7-x64

10

grhsghsGHs...eg.exe

windows10-2004-x64

10

grhsghsGHs...5H.exe

windows7-x64

10

grhsghsGHs...5H.exe

windows10-2004-x64

10

grhsghsGHs...XN.exe

windows7-x64

10

grhsghsGHs...XN.exe

windows10-2004-x64

10

grhsghsGHs...T3.exe

windows7-x64

10

grhsghsGHs...T3.exe

windows10-2004-x64

10

grhsghsGHs...9r.exe

windows7-x64

10

grhsghsGHs...9r.exe

windows10-2004-x64

10

grhsghsGHs...GR.exe

windows7-x64

10

grhsghsGHs...GR.exe

windows10-2004-x64

10

grhsghsGHs...EX.exe

windows7-x64

10

grhsghsGHs...EX.exe

windows10-2004-x64

10

grhsghsGHs...EA.exe

windows7-x64

10

grhsghsGHs...EA.exe

windows10-2004-x64

10

grhsghsGHs...FB.exe

windows7-x64

10

grhsghsGHs...FB.exe

windows10-2004-x64

10

Resubmissions

25-01-2024 16:55

240125-vfcyksbhgr 10

24-01-2024 17:15

240124-vstf4aecaj 10

23-01-2024 19:27

240123-x6cfvagbd9 10

23-01-2024 19:27

240123-x6bvbafgem 10

23-01-2024 19:27

240123-x6bjjsgbd8 10

23-01-2024 19:27

240123-x6ax1sfgek 10

23-01-2024 19:27

240123-x6abgsfgej 10

23-01-2024 19:27

240123-x591qagbd7 10

23-01-2024 19:27

240123-x59d7agbd6 10

23-01-2024 19:27

240123-x584esgbd5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    grhsghsGHswghs.zip

  • Size

    53.3MB

  • Sample

    240124-vstf4aecaj

  • MD5

    533ca99ff496fe94384e08be4543ece9

  • SHA1

    23e9ac7eb659a166959856a04d5c124721df2a38

  • SHA256

    165a0de3cbb54178e47215a0ad412c91f1cbbcefc3c3d35d8124c5972d1c1950

  • SHA512

    c6155011159aa102d681d8c5aa19dde57dbe1fe3fea68670d41dddd07fb1204f0c5d9951c1d65085acf93a78732fed037581fcbbc597143f59ae25d4ffc76c8c

  • SSDEEP

    1572864:HS7A5V1y7xaCcUHNsUZ04Wp3xWytXPDg+yS03gXn4yu:HSkL1yPXW1p3D0SLX4N

Score
10/10
kinsingxmrigloaderminerupx

Malware Config

Targets

    • Target

      grhsghsGHswgh/3JynzWc6LxNCT2y8.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      grhsghsGHswgh/6aNn9vLJCQVfagSE.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      grhsghsGHswgh/6vHkJ4UErTSS5ECD.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

    • Target

      grhsghsGHswgh/Be5sCbvuma2nkHDa.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral7behavioral8

    • Target

      grhsghsGHswgh/DLKFnAGYJBNTnxwq.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    kinsingxmrigloaderminerupx

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral10behavioral9

    • Target

      grhsghsGHswgh/EtPLMpbCyFJpMJr7.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral11behavioral12

    • Target

      grhsghsGHswgh/Gu3PdXt79NF7EJXJ.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupxkinsingloader

    • Kinsing

      Kinsing is a loader written in Golang.

      loaderkinsing

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral13behavioral14

    • Target

      grhsghsGHswgh/JqLvG94UkYjhxAeg.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral15behavioral16

    • Target

      grhsghsGHswgh/LM3BR4UBmKBzBP5H.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral17behavioral18

    • Target

      grhsghsGHswgh/M8xUNW42QxTLMRXN.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral19behavioral20

    • Target

      grhsghsGHswgh/Q5EUCWHU7pMYBfT3.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral21behavioral22

    • Target

      grhsghsGHswgh/UMRsPGc4u9tycx9r.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral23behavioral24

    • Target

      grhsghsGHswgh/UU4Ddwqm5zcuLzGR.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral25behavioral26

    • Target

      grhsghsGHswgh/XJEzW6M7WvHaF3EX.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral27behavioral28

    • Target

      grhsghsGHswgh/Y2JYGshMHJGuGREA.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral29behavioral30

    • Target

      grhsghsGHswgh/Yvdp8t5knpQz7sFB.exe

    • Size

      2.0MB

    • MD5

      a16a669a09bf158058b83e04e69fe38e

    • SHA1

      f6c94763850d9e590d86057139e8895a7aacdeea

    • SHA256

      cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

    • SHA512

      658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

    • SSDEEP

      49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

xmrigminerupx
Score
10/10

behavioral2

kinsingxmrigloaderminerupx
Score
10/10

behavioral3

xmrigminerupx
Score
10/10

behavioral4

kinsingxmrigloaderminerupx
Score
10/10

behavioral5

xmrigminerupx
Score
10/10

behavioral6

kinsingxmrigloaderminerupx
Score
10/10

behavioral7

xmrigminerupx
Score
10/10

behavioral8

kinsingxmrigloaderminerupx
Score
10/10

behavioral9

xmrigminerupx
Score
10/10

behavioral10

kinsingxmrigloaderminerupx
Score
10/10

behavioral11

xmrigminerupx
Score
10/10

behavioral12

kinsingxmrigloaderminerupx
Score
10/10

behavioral13

xmrigminerupx
Score
10/10

behavioral14

kinsingxmrigloaderminerupx
Score
10/10

behavioral15

xmrigminerupx
Score
10/10

behavioral16

xmrigminerupx
Score
10/10

behavioral17

xmrigminerupx
Score
10/10

behavioral18

xmrigminerupx
Score
10/10

behavioral19

xmrigminerupx
Score
10/10

behavioral20

xmrigminerupx
Score
10/10

behavioral21

xmrigminerupx
Score
10/10

behavioral22

xmrigminerupx
Score
10/10

behavioral23

xmrigminerupx
Score
10/10

behavioral24

xmrigminerupx
Score
10/10

behavioral25

xmrigminerupx
Score
10/10

behavioral26

xmrigminerupx
Score
10/10

behavioral27

xmrigminerupx
Score
10/10

behavioral28

xmrigminerupx
Score
10/10

behavioral29

xmrigminerupx
Score
10/10

behavioral30

xmrigminerupx
Score
10/10

behavioral31

xmrigminerupx
Score
10/10

behavioral32

xmrigminerupx
Score
10/10