General
- Target 2026-07-16_113c549bf6367efde153ed1313e28bb6_akira_icedid_rusty-stealer
- Size 2.9MB
- Sample260716-pcafdsgw3t
- SHA256 e6b46a02e7976fa66c410591b4ed514c05f4d97f78e461384e407aa55d17795b
Score
10/10
Malware Config
Targets
-
- Target 2026-07-16_113c549bf6367efde153ed1313e28bb6_akira_icedid_rusty-stealer
- Size 2.9MB
- SHA256 e6b46a02e7976fa66c410591b4ed514c05f4d97f78e461384e407aa55d17795b
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Modifies WinLogon for persistence
-
Windows security bypass
-
XMRig Miner payload
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers new Windows logon scripts automatically executed at logon.
-
Windows security modification
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1