General

  • Target

    2025-03-30_7c38f2d4e90052104fd1560afcf3ba3d_aspxspy_black-basta_ezcob_xmrig

  • Size

    5.0MB

  • Sample

    250330-tdbr3atrx8

  • MD5

    7c38f2d4e90052104fd1560afcf3ba3d

  • SHA1

    d66ae01d41943d0527a4f0a366fc75cdad25d593

  • SHA256

    f2cf6ad65c6a1bbe5301bd963909bc9eb5aea2f29b2e2c9a771b381dd858cb97

  • SHA512

    49e0f1fe6fdcf4479ab0d433dfda5b7ace7d8417e97d93dc44c583a6d5ba548836161da6ff8fe12a9a43424f846574fd10da269b6ed98a202ead4722b85ee543

  • SSDEEP

    98304:z1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHr8g:zbBeSFkG

Malware Config

Targets

    • Target

      2025-03-30_7c38f2d4e90052104fd1560afcf3ba3d_aspxspy_black-basta_ezcob_xmrig

    • Size

      5.0MB

    • MD5

      7c38f2d4e90052104fd1560afcf3ba3d

    • SHA1

      d66ae01d41943d0527a4f0a366fc75cdad25d593

    • SHA256

      f2cf6ad65c6a1bbe5301bd963909bc9eb5aea2f29b2e2c9a771b381dd858cb97

    • SHA512

      49e0f1fe6fdcf4479ab0d433dfda5b7ace7d8417e97d93dc44c583a6d5ba548836161da6ff8fe12a9a43424f846574fd10da269b6ed98a202ead4722b85ee543

    • SSDEEP

      98304:z1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHr8g:zbBeSFkG

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks