xmrig

General

Target

93de3d1a50067678bbe8a82d04aad5157f609abb8500fe379f237b1e437ecb41
Size

3.1MB
Sample

240308-z2r2vaha3y
MD5

0542f1c507d2d5be5c42f5b165c35087
SHA1

7024f11ba400b9aaae1c5ff8f405aced0dcea8d5
SHA256

93de3d1a50067678bbe8a82d04aad5157f609abb8500fe379f237b1e437ecb41
SHA512

907077cde984c276ced5176a9ec251a64f6fbd3ce4737980cc72e3d0350041417db73b20ca346bb9b4e13d0cd190bb5189644592eaed769291903dcafe982121
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:SbBeSFkl

Score

10^/10

Malware Config

Targets

- Target
  
  93de3d1a50067678bbe8a82d04aad5157f609abb8500fe379f237b1e437ecb41
- Size
  
  3.1MB
- MD5
  
  0542f1c507d2d5be5c42f5b165c35087
- SHA1
  
  7024f11ba400b9aaae1c5ff8f405aced0dcea8d5
- SHA256
  
  93de3d1a50067678bbe8a82d04aad5157f609abb8500fe379f237b1e437ecb41
- SHA512
  
  907077cde984c276ced5176a9ec251a64f6fbd3ce4737980cc72e3d0350041417db73b20ca346bb9b4e13d0cd190bb5189644592eaed769291903dcafe982121
- SSDEEP
  
  98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:SbBeSFkl
Score

10^/10

xmrig miner upx
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Detects executables containing URLs to raw contents of a Github gist

UPX dump on OEP (original entry point)

XMRig Miner payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2