xmrig

General

Target

a374dd33cc25addf3fe6c7b087c008e6654af2d3443ed3e429079fb949dfb8e9.exe
Size

10.0MB
Sample

241219-kczytswrfv
MD5

8ab764535973924439bb15e368ee6c0e
SHA1

4849a45be27b9b8bc725522a3ae9cddd6ee705b8
SHA256

a374dd33cc25addf3fe6c7b087c008e6654af2d3443ed3e429079fb949dfb8e9
SHA512

b0a227370851e7fc8f06e6eb16d05ee7d754b864f739aaba9f4f63970f99a0f9657a9b65429a64f903b2ee69849871a0c88c77e05ad29ae78e018db47facd5c3
SSDEEP

49152:dcv8vvuwroS/mx7EtiK6oWYSYNgYTSSGT70cmTNvSWy2XtCnTycFDySVuHjHnMF:H2hUm7EtiaSGgD7aBvfyqCOY/+jH8

Score

10^/10

Malware Config

Targets

- Target
  
  a374dd33cc25addf3fe6c7b087c008e6654af2d3443ed3e429079fb949dfb8e9.exe
- Size
  
  10.0MB
- MD5
  
  8ab764535973924439bb15e368ee6c0e
- SHA1
  
  4849a45be27b9b8bc725522a3ae9cddd6ee705b8
- SHA256
  
  a374dd33cc25addf3fe6c7b087c008e6654af2d3443ed3e429079fb949dfb8e9
- SHA512
  
  b0a227370851e7fc8f06e6eb16d05ee7d754b864f739aaba9f4f63970f99a0f9657a9b65429a64f903b2ee69849871a0c88c77e05ad29ae78e018db47facd5c3
- SSDEEP
  
  49152:dcv8vvuwroS/mx7EtiK6oWYSYNgYTSSGT70cmTNvSWy2XtCnTycFDySVuHjHnMF:H2hUm7EtiaSGgD7aBvfyqCOY/+jH8
Score

10^/10

xmrig evasion execution miner persistence upx
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2