xmrig | ccee0da79de6dc0bbe2e000a75fb65f1a92069bea14d0df37805a84ca9174756

General

Target
2026-07-01_5e5fe9ca2962299f096a96ba4baf57b6_cobalt-strike_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig
Size 6.6MB
Sample260701-x2fmpsez81
SHA256 ccee0da79de6dc0bbe2e000a75fb65f1a92069bea14d0df37805a84ca9174756
MD5 5e5fe9ca2962299f096a96ba4baf57b6
SHA1 fa4329454062a0a831806c11377801219c261981
SHA512 0fddfc8b040f90d03c83a3e29c436d5f7ce1c92679aff29e44530f902732625df7b86ff02ae8562542388247e9b3e01dad1b71f27517a148f65945f68039a989
SSDEEP 98304:+YizMKlfOch9/+EO9uwZKSLQeCin5hn4kqAYWzI5436dvKR1Wakz8CiFd4x44KDP:+YitQcFAYf43AvKREVziL4exnE
TLSH
T1EC669D26B7A401E8C8BEC53CC64B9603E7B2B8555370ABDB16B0567A1F237D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_5e5fe9ca2962299f096a96ba4baf57b6_cobalt-strike_coinminer_darkgate_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig
- Size 6.6MB
- SHA256 ccee0da79de6dc0bbe2e000a75fb65f1a92069bea14d0df37805a84ca9174756
- MD5 5e5fe9ca2962299f096a96ba4baf57b6
- SHA1 fa4329454062a0a831806c11377801219c261981
- SHA512 0fddfc8b040f90d03c83a3e29c436d5f7ce1c92679aff29e44530f902732625df7b86ff02ae8562542388247e9b3e01dad1b71f27517a148f65945f68039a989
- SSDEEP 98304:+YizMKlfOch9/+EO9uwZKSLQeCin5hn4kqAYWzI5436dvKR1Wakz8CiFd4x44KDP:+YitQcFAYf43AvKREVziL4exnE
- TLSH
  T1EC669D26B7A401E8C8BEC53CC64B9603E7B2B8555370ABDB16B0567A1F237D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xmrig miner adware defense_evasion persistence spyware
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2