Overview

overview

10

Static

static

10

2026-06-04...ig.exe

windows10-2004-x64

10

2026-06-04...ig.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig
  • Size 11.5MB
  • Sample260604-rxqdfsgw3x
  • SHA256 38b98174ac3b857a44db550d0a1c7912ed8dd6a8767cfb5702c4b9859dce41f3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
xmrigdefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target
      2026-06-04_b3e186627ba6aa3a7cb7612347874cb0_cobalt-strike_coinminer_elex_emotet_glassworm_icedid_njrat_remcos_vidar_xmrig
    • Size 11.5MB
    • SHA256 38b98174ac3b857a44db550d0a1c7912ed8dd6a8767cfb5702c4b9859dce41f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationupx

    • Family: xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Detects executables referencing many IR and analysis tools

    • UPX dump on OEP (original entry point)

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Disables service(s)

      defense_evasionexecution

    • Executes dropped EXE

    • Stops running service(s)

      defense_evasionexecution

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks