General

  • Target

    2025-03-30_cdec7e91039f34eedc932084d6cc5cbb_aspxspy_black-basta_ezcob_xmrig

  • Size

    5.0MB

  • Sample

    250330-tglrfassa1

  • MD5

    cdec7e91039f34eedc932084d6cc5cbb

  • SHA1

    0b01a6fc9ab830c3952c86beac9d2f7fe162e55e

  • SHA256

    7e1231ce93795ed0e44c7dc2921b7627807072f19f2fb5cacb7f8666d9817831

  • SHA512

    8fd2a178bebc2df9a63ba83048b701aaf6fce97bdea88af9e6e026c59e87083d5315d6cee3237d8c85ab186b002f98a9f4a6e564d3373e01808ce3610775cf0c

  • SSDEEP

    98304:z1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHr8d:zbBeSFkX

Malware Config

Targets

    • Target

      2025-03-30_cdec7e91039f34eedc932084d6cc5cbb_aspxspy_black-basta_ezcob_xmrig

    • Size

      5.0MB

    • MD5

      cdec7e91039f34eedc932084d6cc5cbb

    • SHA1

      0b01a6fc9ab830c3952c86beac9d2f7fe162e55e

    • SHA256

      7e1231ce93795ed0e44c7dc2921b7627807072f19f2fb5cacb7f8666d9817831

    • SHA512

      8fd2a178bebc2df9a63ba83048b701aaf6fce97bdea88af9e6e026c59e87083d5315d6cee3237d8c85ab186b002f98a9f4a6e564d3373e01808ce3610775cf0c

    • SSDEEP

      98304:z1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHr8d:zbBeSFkX

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks