xmrig | cf402bef490c16132928c147bbc67d79db467e0855930d32db70757f6bb67335

General

Target
2141.dll
Size 108KB
Sample260626-txlrdadt8m
SHA256 cf402bef490c16132928c147bbc67d79db467e0855930d32db70757f6bb67335
MD5 426137797b14e37c219c60564953c1b7
SHA1 5a36b65726988ccd9987e23c0369d14e0c3e962f
SHA512 aaec58bdeca86a6c00f498f23c7046e0d9c79d347af4325608c48dc56bf7c9ea3dc791929f9281dc6e3d22bf25f6a02541b02b398134bb0ca2e632f824e28492
SSDEEP 3072:fmUwL4jIXFzFImIluRS5YKVfvpJbrvb6OC:fmCIVxImWuRS5YKVfRJbDH
TLSH
T18EB30217B89211DCE8695AB2048F6E90A77A7F203F5687DF3FB2770C6D346E055B1824
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2141.dll
- Size 108KB
- SHA256 cf402bef490c16132928c147bbc67d79db467e0855930d32db70757f6bb67335
- MD5 426137797b14e37c219c60564953c1b7
- SHA1 5a36b65726988ccd9987e23c0369d14e0c3e962f
- SHA512 aaec58bdeca86a6c00f498f23c7046e0d9c79d347af4325608c48dc56bf7c9ea3dc791929f9281dc6e3d22bf25f6a02541b02b398134bb0ca2e632f824e28492
- SSDEEP 3072:fmUwL4jIXFzFImIluRS5YKVfvpJbrvb6OC:fmCIVxImWuRS5YKVfRJbDH
- TLSH
  T18EB30217B89211DCE8695AB2048F6E90A77A7F203F5687DF3FB2770C6D346E055B1824
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer xmrig miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2