xmrig

General

Target

2025-03-27_06d8029fd7cb9f12d121f936433c191d_black-basta_coinminer_darkgate_hijackloader_luca-stealer_magniber
Size

15.7MB
Sample

250327-jqkkmayybt
MD5

06d8029fd7cb9f12d121f936433c191d
SHA1

eb456ebc23601b2290f627a292c638d3bd73f9b3
SHA256

325fec27cfd9bacb93e2fe9f984a65adb886b6dcfbe6955404571419569e30f4
SHA512

05fae54f2971c2e57a38bfaddedfafad16312890449425f09792fa6efde62de4dfaa3ef7a12a90b5ab246303ba96fab82cd1d43c71eeb348453a1d47923d782d
SSDEEP

196608:xAACNbhcF1WKW6whfOjGvAWHMMH1OAY8PyedZLOOW7j7XlivZqOXmtubmxl5ppr6:xAAghcflGvF0t7iZqptmmH5Hm

Score

10^/10

Malware Config

Targets

- Target
  
  2025-03-27_06d8029fd7cb9f12d121f936433c191d_black-basta_coinminer_darkgate_hijackloader_luca-stealer_magniber
- Size
  
  15.7MB
- MD5
  
  06d8029fd7cb9f12d121f936433c191d
- SHA1
  
  eb456ebc23601b2290f627a292c638d3bd73f9b3
- SHA256
  
  325fec27cfd9bacb93e2fe9f984a65adb886b6dcfbe6955404571419569e30f4
- SHA512
  
  05fae54f2971c2e57a38bfaddedfafad16312890449425f09792fa6efde62de4dfaa3ef7a12a90b5ab246303ba96fab82cd1d43c71eeb348453a1d47923d782d
- SSDEEP
  
  196608:xAACNbhcF1WKW6whfOjGvAWHMMH1OAY8PyedZLOOW7j7XlivZqOXmtubmxl5ppr6:xAAghcflGvF0t7iZqptmmH5Hm
Score

10^/10

xmrig bootkit defense_evasion discovery evasion execution exploit miner persistence privilege_escalation spyware stealer trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Disables service(s)
  defense_evasion execution
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  persistence
- Stops running service(s)
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2