Overview

overview

10

Static

static

10

2025-04-07...ig.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-07_4bc4a4f8ca36aa1255b2dc7d6381972c_aspxspy_black-basta_ezcob_imuler_xmrig

  • Size

    5.7MB

  • Sample

    250407-m8hersxsf1

  • MD5

    4bc4a4f8ca36aa1255b2dc7d6381972c

  • SHA1

    865b8521c9ef5673dabfde0e55a7e3ecaebfdfa4

  • SHA256

    27e5d486fa635f54bcde82d0d1c940d6aaa18e3ff00a77896cd47f1955b03ea1

  • SHA512

    4a6fc99c4e4ff2c936118026358beab370d72e649b39ecc34058d9b39ea544ea94aa80cf4053f03ffefff17d2e9a62e66ca37bacab0ed1097ddbe8ad6e73f7a1

  • SSDEEP

    98304:z1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHr8D:zbBeSFkd

Score
10/10
xmrigexecutionminerpersistenceupx

Malware Config

Targets

    • Target

      2025-04-07_4bc4a4f8ca36aa1255b2dc7d6381972c_aspxspy_black-basta_ezcob_imuler_xmrig

    • Size

      5.7MB

    • MD5

      4bc4a4f8ca36aa1255b2dc7d6381972c

    • SHA1

      865b8521c9ef5673dabfde0e55a7e3ecaebfdfa4

    • SHA256

      27e5d486fa635f54bcde82d0d1c940d6aaa18e3ff00a77896cd47f1955b03ea1

    • SHA512

      4a6fc99c4e4ff2c936118026358beab370d72e649b39ecc34058d9b39ea544ea94aa80cf4053f03ffefff17d2e9a62e66ca37bacab0ed1097ddbe8ad6e73f7a1

    • SSDEEP

      98304:z1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHr8D:zbBeSFkd

    Score
    10/10
    xmrigexecutionminerpersistenceupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks