xmrig

General

Target

04b708fad2bcc13140baa7563d5fb25d46d3c9f44f128662a9000be4cee25f3c
Size

3.1MB
Sample

240319-vt71wahd76
MD5

12f2b11cc3fa7337bd82e54aed32e744
SHA1

997095bebf68ba0a312ceb11e569be32b2705b73
SHA256

04b708fad2bcc13140baa7563d5fb25d46d3c9f44f128662a9000be4cee25f3c
SHA512

9774fc95b4f53ff94dc854eb6f5664675a3292e28a7d50738a29252f1a4d095a596d77ad00501ad017960187e63d0ec7835816ecd59d7260b03456419765b3fc
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:SbBeSFku

Score

10^/10

Malware Config

Targets

- Target
  
  04b708fad2bcc13140baa7563d5fb25d46d3c9f44f128662a9000be4cee25f3c
- Size
  
  3.1MB
- MD5
  
  12f2b11cc3fa7337bd82e54aed32e744
- SHA1
  
  997095bebf68ba0a312ceb11e569be32b2705b73
- SHA256
  
  04b708fad2bcc13140baa7563d5fb25d46d3c9f44f128662a9000be4cee25f3c
- SHA512
  
  9774fc95b4f53ff94dc854eb6f5664675a3292e28a7d50738a29252f1a4d095a596d77ad00501ad017960187e63d0ec7835816ecd59d7260b03456419765b3fc
- SSDEEP
  
  98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:SbBeSFku
Score

10^/10

xmrig miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables containing URLs to raw contents of a Github gist

UPX dump on OEP (original entry point)

XMRig Miner payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2