xmrig

General

Target

e601f518e2155edf8488b13c86aff66535e66c6d28e6030a23447c870a549585
Size

2.6MB
Sample

240409-3zmwwsaf84
MD5

4b0b25bb69bab2147a8b69184a38bb05
SHA1

da0489ac164335b04ae6469286fa4736c3aa99c6
SHA256

e601f518e2155edf8488b13c86aff66535e66c6d28e6030a23447c870a549585
SHA512

07d6f635a0f6acbaea010577533e9cddda9a5e339c1709cfc6c7ae0b25a7388dd98b3d37bcb7bc3303c1b13ed47f8fdd13a389aa3d0ff2c61c91f4affaad5b2c
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WtqfvB:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2

Score

10^/10

Malware Config

Targets

- Target
  
  e601f518e2155edf8488b13c86aff66535e66c6d28e6030a23447c870a549585
- Size
  
  2.6MB
- MD5
  
  4b0b25bb69bab2147a8b69184a38bb05
- SHA1
  
  da0489ac164335b04ae6469286fa4736c3aa99c6
- SHA256
  
  e601f518e2155edf8488b13c86aff66535e66c6d28e6030a23447c870a549585
- SHA512
  
  07d6f635a0f6acbaea010577533e9cddda9a5e339c1709cfc6c7ae0b25a7388dd98b3d37bcb7bc3303c1b13ed47f8fdd13a389aa3d0ff2c61c91f4affaad5b2c
- SSDEEP
  
  49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8Cnki2WtqfvB:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
Score

10^/10

xmrig miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables containing URLs to raw contents of a Github gist

UPX dump on OEP (original entry point)

XMRig Miner payload

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2