xmrig

General

Target

9ec6e2b5b183f454415c0ed222fe9537760e615fa9ee5e95fb098157a8d15637
Size

2.6MB
Sample

240315-192fxsec63
MD5

9dd3f236f36d397f0f80004952e1791d
SHA1

63b8dc2958ea5387b67a38f19be91c055832fe42
SHA256

9ec6e2b5b183f454415c0ed222fe9537760e615fa9ee5e95fb098157a8d15637
SHA512

ceb07c0558f383702f4f0048e7f01572f3e31b1a69029b36f03dd440ff0d90d597c991724fa9c54bfe8556293f667577393df81b81337a0d5a7b4376cb417a54
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hjGhql0lQO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR

Score

10^/10

Malware Config

Targets

- Target
  
  9ec6e2b5b183f454415c0ed222fe9537760e615fa9ee5e95fb098157a8d15637
- Size
  
  2.6MB
- MD5
  
  9dd3f236f36d397f0f80004952e1791d
- SHA1
  
  63b8dc2958ea5387b67a38f19be91c055832fe42
- SHA256
  
  9ec6e2b5b183f454415c0ed222fe9537760e615fa9ee5e95fb098157a8d15637
- SHA512
  
  ceb07c0558f383702f4f0048e7f01572f3e31b1a69029b36f03dd440ff0d90d597c991724fa9c54bfe8556293f667577393df81b81337a0d5a7b4376cb417a54
- SSDEEP
  
  49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hjGhql0lQO:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
Score

10^/10

xmrig miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables containing URLs to raw contents of a Github gist

UPX dump on OEP (original entry point)

XMRig Miner payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2