General
- Target 2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 309KB
- Sample260604-bzag1sgv4x
- SHA256 72f7d41848a367d0b0693ea86c0b2c80a85adbd14ae06f69b28bc44e3586de4a
Score
10/10
Malware Config
Targets
-
- Target 2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 309KB
- SHA256 72f7d41848a367d0b0693ea86c0b2c80a85adbd14ae06f69b28bc44e3586de4a
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Custom signature
Detects executables referencing many IR and analysis tools
XMRig Miner payload
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Possible privilege escalation attempt
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Modifies file permissions
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1