xmrig | 073b2ed5d89fa75537fb15a4d5899b416fd45851aeb04a2f856e6b156dd1aff4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

31fb8d62ad...KI.exe

windows7-x64

31fb8d62ad...KI.exe

windows10-2004-x64

Sharing

General

Target

31fb8d62ad305a58210ee8ae996e6e10_NEIKI
Size

1.6MB
Sample

240508-km26yaee93
MD5

31fb8d62ad305a58210ee8ae996e6e10
SHA1

087d81d5544cd3478ea53c25f56227f0a013b52d
SHA256

073b2ed5d89fa75537fb15a4d5899b416fd45851aeb04a2f856e6b156dd1aff4
SHA512

aaaba80677c5c97056a79ea4d526576cd6b3c497dab91ad6a650b999ec377fc8271848b88da0b87983056547f21d43af97b8cb5591fb7d8ca56c6f3302aa0f62
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXiBLNpcU:Lz071uv4BPMkHC0IaSEzQR4iRlv

Score

10^/10

xmrig execution miner upx

Static task

static1

upx miner xmrig

4 signatures

Behavioral task

behavioral1

Sample

31fb8d62ad305a58210ee8ae996e6e10_NEIKI.exe

Resource

win7-20231129-en

xmrig execution miner upx

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

31fb8d62ad305a58210ee8ae996e6e10_NEIKI.exe

Resource

win10v2004-20240226-en

xmrig execution miner upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  31fb8d62ad305a58210ee8ae996e6e10_NEIKI
- Size
  
  1.6MB
- MD5
  
  31fb8d62ad305a58210ee8ae996e6e10
- SHA1
  
  087d81d5544cd3478ea53c25f56227f0a013b52d
- SHA256
  
  073b2ed5d89fa75537fb15a4d5899b416fd45851aeb04a2f856e6b156dd1aff4
- SHA512
  
  aaaba80677c5c97056a79ea4d526576cd6b3c497dab91ad6a650b999ec377fc8271848b88da0b87983056547f21d43af97b8cb5591fb7d8ca56c6f3302aa0f62
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXiBLNpcU:Lz071uv4BPMkHC0IaSEzQR4iRlv
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy