General
- Target 2026-07-03_5ca80aa666e334cce69cde175c673b21_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver
- Size 3.2MB
- Sample260703-ps26caht5w
- SHA256 a7a17adf8761e4ad7fa711214a5c6901dd0d46bab7b25410ab6d746bbd4ad6e1
Score
10/10
Malware Config
Targets
-
- Target 2026-07-03_5ca80aa666e334cce69cde175c673b21_coinminer_frostygoop_hive_luca-stealer_salatstealer_sliver
- Size 3.2MB
- SHA256 a7a17adf8761e4ad7fa711214a5c6901dd0d46bab7b25410ab6d746bbd4ad6e1
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
- Custom signature
UPX dump on OEP (original entry point)
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Creates new service(s)
Executes dropped EXE
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Adds Run key to start application
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1