xmrig

General

Target

0cf95bfc8dba4c9824685c891b7f6000_NEIKI
Size

3.2MB
Sample

240508-xb5h5sca24
MD5

0cf95bfc8dba4c9824685c891b7f6000
SHA1

b859ba5029062be846711e2f4b8b975e2f823341
SHA256

7e1c292c7a8756fbff74cd5b604c0482ad1856ddf6c18411f9560b6c6f9fd784
SHA512

bb6cee69581f6188200b95f9374214427af40153a1d19f5dfc13d92dd7599d1fa0c46e4a5a605ded2f80e327b24026e85b7c4349409c0415d7a03f76e14056e3
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:SbBeSFkT

Score

10^/10

Malware Config

Targets

- Target
  
  0cf95bfc8dba4c9824685c891b7f6000_NEIKI
- Size
  
  3.2MB
- MD5
  
  0cf95bfc8dba4c9824685c891b7f6000
- SHA1
  
  b859ba5029062be846711e2f4b8b975e2f823341
- SHA256
  
  7e1c292c7a8756fbff74cd5b604c0482ad1856ddf6c18411f9560b6c6f9fd784
- SHA512
  
  bb6cee69581f6188200b95f9374214427af40153a1d19f5dfc13d92dd7599d1fa0c46e4a5a605ded2f80e327b24026e85b7c4349409c0415d7a03f76e14056e3
- SSDEEP
  
  98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWf:SbBeSFkT
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

XMRig Miner payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2