xmrig | 881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774 | Triage

Submit
Reports

Overview

overview

Static

static

3

881f48b7bb...74.exe

windows7-x64

7

881f48b7bb...74.exe

windows10-2004-x64

Sharing

General

Target

881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe
Size

6.1MB
Sample

241117-jh2h6syphr
MD5

fa1e1544d3c43fc8a9b1f4142b046391
SHA1

c4a1b757c5bd90d7e59e84c009c2c5f19471fefe
SHA256

881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774
SHA512

e86c5f4bb723c02cfa772e7fa5ab7afff22212057cbe52ca1f0cc4d9a34410b511e2e75c8f9eab4bc4d50cbbeba156ca9d4a4b12aa29052c67ba47494ee2a2d9
SSDEEP

98304:sMDtIXLr06AdfEThF35PzuY+NmU7afvNN5+N6F8c5AvtfXmJ+PigmgI:UrmEdF3D+NmcaNNH8Uotnmz

Score

10^/10

xmrig defense_evasion discovery execution miner pyinstaller

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe

Resource

win7-20241010-en

windows7-x64

6 signatures

120 seconds

Behavioral task

behavioral2

Sample

881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe

Resource

win10v2004-20241007-en

xmrig defense_evasion discovery execution miner pyinstaller

windows10-2004-x64

21 signatures

120 seconds

Malware Config

Targets

- Target
  
  881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774.exe
- Size
  
  6.1MB
- MD5
  
  fa1e1544d3c43fc8a9b1f4142b046391
- SHA1
  
  c4a1b757c5bd90d7e59e84c009c2c5f19471fefe
- SHA256
  
  881f48b7bb0843623dd37e519ba30d51cb19b324bb992167eda19df2e97e7774
- SHA512
  
  e86c5f4bb723c02cfa772e7fa5ab7afff22212057cbe52ca1f0cc4d9a34410b511e2e75c8f9eab4bc4d50cbbeba156ca9d4a4b12aa29052c67ba47494ee2a2d9
- SSDEEP
  
  98304:sMDtIXLr06AdfEThF35PzuY+NmU7afvNN5+N6F8c5AvtfXmJ+PigmgI:UrmEdF3D+NmcaNNH8Uotnmz
Score

10^/10

discovery xmrig defense_evasion execution miner pyinstaller
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Obfuscated Files or Information

Command Obfuscation

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

xmrigdefense_evasiondiscoveryexecutionminerpyinstaller

© 2018-2025

Terms | Privacy