xmrig | e7a217b2a19e654dbdc608121b7182652df8a73f8f6e83283e63c43323f36b3b

Resubmissions

21/07/2026, 06:57

260721-hqy8caay8110

21/07/2026, 06:54

260721-hpbewsay8s10

21/07/2026, 06:50

260721-hl554ag18q10

Sharing

Copy URL Twitter E-mail

General

Target
test.7z
Size 11.1MB
Sample260721-hl554ag18q
SHA256 e7a217b2a19e654dbdc608121b7182652df8a73f8f6e83283e63c43323f36b3b
MD5 f2dc0d665d1fabd17703300c166eb7de
SHA1 c2dd1e3baad0c0f65343ab0552a9fc18964efebc
SHA512 6d70a7880e221a1e429b8c76225a382bd665391ef27d623809be54eaab937200e27b606486bec53adeabb3b9cc7d8bdc97b5367042416ce4ea04fc58c9a0e44e
SSDEEP 196608:vmhKOoq53cWO+pIgECwGN1guKG1OLXABXl89KSAG82dEPt9Yftulk6/PdtvL5K:vXOoq53NO+pjERGN1FKGkLXABu3AG3qq
TLSH
T1BEC6335F115B3A83D8F7E2AFE87E33B78F87C6802C29D29D249AD480851DDD669701E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  svctrl64.exe
- Size 6.6MB
- SHA256 260e7a89ccd71ea80ad63d26118ef401a55b4262631815f3fe5e8abffaf06d42
- MD5 9250f46406d60f9867a0423de9dd71af
- SHA1 5559e7d3bbb3777feecab56b54bd5eabdcbd4f35
- SHA512 bdb8009f16d6704f526ccc0b441e897a7de79632d11839e76314fc114d31ef331f3567e600925274ebd26f2ed8e76ed142e6c4e2f62b34ce36570f068d61d09b
- SSDEEP 98304:bmZGzD8HbmyX3UqD/BIMUt2ypuFc/UVsh2K98nrwt+1GiI:bTz8myX3UO/BINt2ypuFc/UVsh2Kewt
- TLSH
  T1A6669D6ABABC00A5D8AAC17CC2976227D772B45517B057CF1A6486FD1F23BE01A7F700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution xmrig miner persistence
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Server Software Component: Terminal Services DLL
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  u471663.dll
- Size 6.3MB
- SHA256 70fb0ba64acf13d1064e862d37b51dd258575289f0cf0e3573db23182d981aa8
- MD5 f376ec48dae2a6d38ada343f386926ff
- SHA1 3186a9a42403f9f2104a7eb54e44adfac7e0ca42
- SHA512 540b913222eaa18f71c023b1256997c5d0e98d9d16368384880363199d161e52a4b9588b6b9e6820b411111850a82e85e6740c28a64074d9cbe42e98117bdfda
- SSDEEP 98304:MGzD8HbmyX3UqD/BIMUt2ypuFc/UVsh2K98nrwt+1GiI:zz8myX3UO/BINt2ypuFc/UVsh2Kewt
- TLSH
  T1EF669C6ABABC00A5D8AAC1BCC2976227D372B45517B057CF1A6486FD1F23BE0167F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  wsvcz/WinRing0x64.sys
- Size 14KB
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH
  T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  wsvcz/u187518.exe
- Size 6.2MB
- SHA256 63aa8da1aedb07d075c13f700877a7525df5b4f434c5f24026a77365517cb225
- MD5 248eed41f083c5de46a15c2b9f30303e
- SHA1 107e18189871d7c9f36af04a5e65bc6a4e6d5da8
- SHA512 4faa293c8508c8d5aa1dc43aeb1d84f1dce946ff7ad2e0630320997e4247f34b3b8f7052e1a80fcf6f45848c1dcf8db277ae51d0d2c4b2a4600679acc5ed1c2a
- SSDEEP 98304:5nAa/8E9ti62iKjDzft5E1eamLuqEQitMQXfqNf45TYK02unAa4eLFaQYJSAj231:5jUMtit9NOMjTnA7saQM9Cwe
- TLSH
  T122569D26B7A400E8C87AC53CCA469513F7B2B81953B0A7DB27B4567A1F336D41E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  wsvcz/u805458.dat
- Size 12.2MB
- SHA256 d074488d58e8d2bd20d19db5c7194ce998d400ac113879b669d421fa788f6642
- MD5 19b5b525e6dfe71de67a923e6782037b
- SHA1 ac10c01bfc761116aba8e9a3486614f0b114c9ab
- SHA512 aa4ee07f5223ad0987eebd6e5465d389f156e5bea5f630c7d0cb77a110d78fee9220788a041febdbaa0669075498e69e970322147dae97faafe77b071c8a0be1
- SSDEEP 196608:UurozrkZSf1dl6ztRwLuS/nl5+nL+ERPGHF82:Uu8zea0tRguS6OL
- TLSH
  T189D63308F1CAD6D1E7585A35EC91C4FD3629BE6AEF65894BB1C57F8F353088A1328407
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  wsvcz/wlogz.dat
- Size 272B
- SHA256 de95a0b5a4b5e1f950ffc41a08a4e1a67c825a6d165994ddd5c0772283c3b76a
- MD5 b4d422661b05e935c18dbc34b3c96250
- SHA1 27025fe420b8dc45252887b92139beba9dc7b873
- SHA512 6042ddc04914a765332bbcdb399c13c859eedb33bede70ee03355b47037c9f0db058f4b16be1fa7300d1ce1049e5723c9835382a9b8bb082d609f9067283b4fc
- TLSH
  T101D02B635244AB18B52954995181F74A8C9918496CD245B28652BBD0275D1E1C84F91B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Family: xmrig

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Server Software Component: Terminal Services DLL

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12