General

  • Target

    ba41dce36ee1a1bc34b7becd086a5eb62ca7fbac8563e01f211f6789690a0ad7N

  • Size

    2.0MB

  • Sample

    241025-tf3zbsserp

  • MD5

    6b2096583f3b4af08ca031aec91f9bb0

  • SHA1

    ae680cbb854f7bed77cec38db3cc2c80457d89c1

  • SHA256

    ba41dce36ee1a1bc34b7becd086a5eb62ca7fbac8563e01f211f6789690a0ad7

  • SHA512

    09bb3943c10b3048de4405eb66419dbcf39fd78a3c87de2ed3668109a96f38e9a672b13b78e23c46d398d1099b394c760ec65fd43a26dbef3dd74568bcbac166

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PT4r:NABM

Malware Config

Targets

    • Target

      ba41dce36ee1a1bc34b7becd086a5eb62ca7fbac8563e01f211f6789690a0ad7N

    • Size

      2.0MB

    • MD5

      6b2096583f3b4af08ca031aec91f9bb0

    • SHA1

      ae680cbb854f7bed77cec38db3cc2c80457d89c1

    • SHA256

      ba41dce36ee1a1bc34b7becd086a5eb62ca7fbac8563e01f211f6789690a0ad7

    • SHA512

      09bb3943c10b3048de4405eb66419dbcf39fd78a3c87de2ed3668109a96f38e9a672b13b78e23c46d398d1099b394c760ec65fd43a26dbef3dd74568bcbac166

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PT4r:NABM

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks