General

  • Target

    a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983

  • Size

    3.1MB

  • Sample

    240708-cm8pqazdnh

  • MD5

    4d6a17eba7f1a734cd9e1d74a7f38d4a

  • SHA1

    43a1314a8726d87695f566120072ee8025bd86eb

  • SHA256

    a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983

  • SHA512

    f2f07e9b90243b548751caa5ef8f138f9a04e3c3e2f09b67d1dae1abfe8c6e1e0a7726e883a1f0e1327252f8495adcc86bd0c72eccc20588f722a51f3eb69341

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkM

Malware Config

Targets

    • Target

      a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983

    • Size

      3.1MB

    • MD5

      4d6a17eba7f1a734cd9e1d74a7f38d4a

    • SHA1

      43a1314a8726d87695f566120072ee8025bd86eb

    • SHA256

      a3e583975479884b52233e84cf01a31cbce6c8a0cbebf9141b5b27793e0ee983

    • SHA512

      f2f07e9b90243b548751caa5ef8f138f9a04e3c3e2f09b67d1dae1abfe8c6e1e0a7726e883a1f0e1327252f8495adcc86bd0c72eccc20588f722a51f3eb69341

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWY:7bBeSFkM

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks