General
- Target 2026-07-03_4fab5550c523a6ee68f545972be570c9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 14.6MB
- Sample260703-weq99aat7n
- SHA256 7994bf8a62624cc6f36e81d7b63b29f5e09e4ff060613509df008cfaddc1f78f
Score
10/10
Malware Config
Targets
-
- Target 2026-07-03_4fab5550c523a6ee68f545972be570c9_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 14.6MB
- SHA256 7994bf8a62624cc6f36e81d7b63b29f5e09e4ff060613509df008cfaddc1f78f
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Windows security bypass
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1