xmrig

General

Target

get.png
Size

8KB
Sample

240328-kpsqaagf7x
MD5

ae465af2287d24ccdeec8035a1e3f159
SHA1

e32c4c6c0a46e409cb81a28fe1aefc2e1aae569b
SHA256

c0fe0c93b610f4e952a51febb4d1473ca9b164250cb6b94b3a360a7c39a7b66e
SHA512

431361d8db7b27cbe22f56379ac6e68c54161bdb4702359ed927f9bb144c1f160688165805d3872044bf884fd66467f2c9da0b048a377d3b50010fcff5104be6
SSDEEP

192:Gswo+GbNlXOxscP5FTHkcJqYfZ13JkIL1SgQ4iPYyoc:Rh+qLOxFxicYIZ13KIU/dPYyj

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://downloadAddress/config.txt

exe.dropper

http://downloadAddress/curl.png

exe.dropper

http://downloadAddress/kill.png

exe.dropper

http://downloadAddress/smartsscreen.png

exe.dropper

http://downloadAddress/get.png

exe.dropper

http://downloadAddress/msdtc/86.png

exe.dropper

http://downloadAddress/msdtc/64.png

exe.dropper

http://downloadAddress/drives/kill.png

exe.dropper

http://downloadAddress/drives/delete.png

exe.dropper

http://111.90.158.40/backup.png

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://111.90.158.40/kill.png?random=20240328084732

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://111.90.158.40/kill.png?random=20240328084716

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://111.90.158.40/get.png?random=1711615656

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://111.90.158.40/kill.png?random=20240328084740

Targets

- Target
  
  get.png
- Size
  
  8KB
- MD5
  
  ae465af2287d24ccdeec8035a1e3f159
- SHA1
  
  e32c4c6c0a46e409cb81a28fe1aefc2e1aae569b
- SHA256
  
  c0fe0c93b610f4e952a51febb4d1473ca9b164250cb6b94b3a360a7c39a7b66e
- SHA512
  
  431361d8db7b27cbe22f56379ac6e68c54161bdb4702359ed927f9bb144c1f160688165805d3872044bf884fd66467f2c9da0b048a377d3b50010fcff5104be6
- SSDEEP
  
  192:Gswo+GbNlXOxscP5FTHkcJqYfZ13JkIL1SgQ4iPYyoc:Rh+qLOxFxicYIZ13KIU/dPYyj
Score

10^/10

xmrig evasion miner persistence ransomware trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- XMRig Miner payload
  miner
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Clears Windows event logs
  evasion ransomware
- Blocklisted process makes network request
- Creates new service(s)
  persistence
- Drops file in Drivers directory
- Stops running service(s)
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2