xmrig | 526db3999d52d326bfdaa6b15a82c081f42067a2cf9b7e132e5d805c5d5fe4d7 | Triage

Sharing

General

Target

AnyDesk.exe
Size

1.3MB
Sample

250201-j27jjawrhq
MD5

31b7349b5ba92393e3430b1ee8a0f59f
SHA1

821f438b1318cef95058888dc0b2b6596a83ef72
SHA256

526db3999d52d326bfdaa6b15a82c081f42067a2cf9b7e132e5d805c5d5fe4d7
SHA512

d0dfc5199fd9984e867f43095487d47274dd54f4436acae02633e0bf33f7f7a08676a639f8ca20457f3db97e74ac544ae703b4a3ab1e29c3f0649dcbd4120cf9
SSDEEP

24576:CT4A/d6wF5q6Yh2JoaCmWJZopqgHCk8jpU/5JtY6v/87xaVUhf4pE05wIML:CMA16wFdjC7JZop5ik8juhJtY6WhfD0G

Score

10^/10

xmrig defense_evasion execution miner persistence

Malware Config

Targets

- Target
  
  AnyDesk.exe
- Size
  
  1.3MB
- MD5
  
  31b7349b5ba92393e3430b1ee8a0f59f
- SHA1
  
  821f438b1318cef95058888dc0b2b6596a83ef72
- SHA256
  
  526db3999d52d326bfdaa6b15a82c081f42067a2cf9b7e132e5d805c5d5fe4d7
- SHA512
  
  d0dfc5199fd9984e867f43095487d47274dd54f4436acae02633e0bf33f7f7a08676a639f8ca20457f3db97e74ac544ae703b4a3ab1e29c3f0649dcbd4120cf9
- SSDEEP
  
  24576:CT4A/d6wF5q6Yh2JoaCmWJZopqgHCk8jpU/5JtY6v/87xaVUhf4pE05wIML:CMA16wFdjC7JZop5ik8juhJtY6WhfD0G
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2

defense_evasionexecutionpersistence