xmrig | 69cb2313282e0dada2a112f47b7f5124c0dfdd14ead4531fbb2a987cbc546a04

General

Target
Discord token joiner.exe
Size 2.5MB
Sample260707-ldyylaex2w
SHA256 69cb2313282e0dada2a112f47b7f5124c0dfdd14ead4531fbb2a987cbc546a04
MD5 e6a6a143b883973f83779cb932969f28
SHA1 eb2786edc74caf1b6431573cf3ae5cfa8707dddd
SHA512 ecd6c9a735758ebc9076fa1bf5f7fa30a892ebc9d9a62f3069b5fb1be27d854447dd95055212da7a6529a09c1b5b538b9f64fdec932cb573d6c6b9cfb172b753
SSDEEP 49152:kn28Dsh5P1cp2CL5tN2Wb248x3/liE7HkvCDp8DUsdFW6x:ksCZRP+9JLsd06x
TLSH
T19FC533870572244AC4954FF44157D248AC0FB1B92B4150C3AF9EAB5B19BEAD07BBF387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Discord token joiner.exe
- Size 2.5MB
- SHA256 69cb2313282e0dada2a112f47b7f5124c0dfdd14ead4531fbb2a987cbc546a04
- MD5 e6a6a143b883973f83779cb932969f28
- SHA1 eb2786edc74caf1b6431573cf3ae5cfa8707dddd
- SHA512 ecd6c9a735758ebc9076fa1bf5f7fa30a892ebc9d9a62f3069b5fb1be27d854447dd95055212da7a6529a09c1b5b538b9f64fdec932cb573d6c6b9cfb172b753
- SSDEEP 49152:kn28Dsh5P1cp2CL5tN2Wb248x3/liE7HkvCDp8DUsdFW6x:ksCZRP+9JLsd06x
- TLSH
  T19FC533870572244AC4954FF44157D248AC0FB1B92B4150C3AF9EAB5B19BEAD07BBF387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan credential_access execution xmrig miner stealer adware
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Renames multiple (6114) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4