xmrig | 7af78321667e8b180cce7d101df25de9613c4e1465a2919365556e923dae1d80 | Triage

Sharing

General

Target

AnyDesk.exe
Size

1.3MB
Sample

250201-jd68vswmbr
MD5

80f423944ecf8de9d7067c0359b88c5c
SHA1

fd40b2a3501ebb0c3e7cb811fd0dbca4f02c3c1d
SHA256

7af78321667e8b180cce7d101df25de9613c4e1465a2919365556e923dae1d80
SHA512

a64b5db6ecc5e3304d977b6eed80eeab613c0a6b0a882403db7d3fddfd908dc7f282f871f9a6fdfa688b412619751dc6d9517ac5d16018657c98b421229c9b6d
SSDEEP

24576:qT4A/dnOFN6gyTWoCAzPRDsaMgHl8E9J/mvtY6v/87xaVUhf4pE0FwI/m:qMA1nOF8iAjRDsafHl8E9JwtY6WhfD0O

Score

10^/10

xmrig defense_evasion execution miner persistence

Malware Config

Targets

- Target
  
  AnyDesk.exe
- Size
  
  1.3MB
- MD5
  
  80f423944ecf8de9d7067c0359b88c5c
- SHA1
  
  fd40b2a3501ebb0c3e7cb811fd0dbca4f02c3c1d
- SHA256
  
  7af78321667e8b180cce7d101df25de9613c4e1465a2919365556e923dae1d80
- SHA512
  
  a64b5db6ecc5e3304d977b6eed80eeab613c0a6b0a882403db7d3fddfd908dc7f282f871f9a6fdfa688b412619751dc6d9517ac5d16018657c98b421229c9b6d
- SSDEEP
  
  24576:qT4A/dnOFN6gyTWoCAzPRDsaMgHl8E9J/mvtY6v/87xaVUhf4pE0FwI/m:qMA1nOF8iAjRDsafHl8E9JwtY6WhfD0O
Score

8^/10

defense_evasion execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Creates new service(s)
  persistence execution
- Drops file in Drivers directory
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionexecutionpersistence