xmrig

Resubmissions

22-09-2024 09:54

240922-lxn8hatcpn 10

07-08-2024 05:02

240807-fn89esvfrd 10

07-08-2024 04:52

240807-fhkzms1gml 10

07-08-2024 04:45

240807-fdp3ss1fpj 10

Sharing

Copy URL

Twitter E-mail

General

Target

66653ef68ff8b558044eaf03f8800910N.exe
Size

1.9MB
Sample

240807-fn89esvfrd
MD5

66653ef68ff8b558044eaf03f8800910
SHA1

7cbfdd33890bb202b6d492aee1854a6202608d5d
SHA256

4ec0047116ccacc3b27ace9afc3891269c9acc8e86cdd018534f177a9329212f
SHA512

180a2e9734672a7828a183f6805731ce6b31e4dd093d8fedae1807fb7f0613f1aa8a60571cdea5272404a9084063c9102324a417084d06805126c780b4f939e0
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9z4:Lz071uv4BPMkibTIA5lCx7kvRWa4puOD

Score

10^/10

Malware Config

Targets

- Target
  
  66653ef68ff8b558044eaf03f8800910N.exe
- Size
  
  1.9MB
- MD5
  
  66653ef68ff8b558044eaf03f8800910
- SHA1
  
  7cbfdd33890bb202b6d492aee1854a6202608d5d
- SHA256
  
  4ec0047116ccacc3b27ace9afc3891269c9acc8e86cdd018534f177a9329212f
- SHA512
  
  180a2e9734672a7828a183f6805731ce6b31e4dd093d8fedae1807fb7f0613f1aa8a60571cdea5272404a9084063c9102324a417084d06805126c780b4f939e0
- SSDEEP
  
  24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9z4:Lz071uv4BPMkibTIA5lCx7kvRWa4puOD
Score

10^/10

xmrig execution miner upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

XMRig Miner payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2