xmrig | f221720d8817f6f9caf678dde62f43e9f19e7cd40e0b941371774caa85ed76fe

General

Target
2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 57.7MB
Sample260418-w4ggcaev2k
SHA256 f221720d8817f6f9caf678dde62f43e9f19e7cd40e0b941371774caa85ed76fe
MD5 54339822a9633d49e230b367333e607f
SHA1 2abe41fad120e74ef3ae40cb7754ca7b0e7c0f9d
SHA512 66e4e9e773a2eab67e083ac9dfacb5e0acca8d0b762577b34d772a858dd717b703295e973e7beb7f22ee16ab0a44bd8dcb66bfcf5b1af2d82d0e08204c09cf63
SSDEEP 1572864:THhVmo6O7f0+wx/W72cG8snGxwR8tpvRs:THhVoOD0+S/WScGDntyy
TLSH
T11CD72217F7A140E8C46EC539C646AA33E7B1B81A5334A7DB2AE4D3651F23AD04E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
- Size 57.7MB
- SHA256 f221720d8817f6f9caf678dde62f43e9f19e7cd40e0b941371774caa85ed76fe
- MD5 54339822a9633d49e230b367333e607f
- SHA1 2abe41fad120e74ef3ae40cb7754ca7b0e7c0f9d
- SHA512 66e4e9e773a2eab67e083ac9dfacb5e0acca8d0b762577b34d772a858dd717b703295e973e7beb7f22ee16ab0a44bd8dcb66bfcf5b1af2d82d0e08204c09cf63
- SSDEEP 1572864:THhVmo6O7f0+wx/W72cG8snGxwR8tpvRs:THhVoOD0+S/WScGDntyy
- TLSH
  T11CD72217F7A140E8C46EC539C646AA33E7B1B81A5334A7DB2AE4D3651F23AD04E3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence ransomware spyware trojan upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Clears Windows event logs
  defense_evasion ransomware
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2