Extracted

• • Target
    tungtung.ps1
  • Size 1KB
  • SHA256 0bd76089e9a297d1e6d323f2ac43788ac57898fcbbd18548d097830b629185ac
  • MD5 c425d06b33fc834f1aa6cca8aa0fdf51
  • SHA1 62dfd4884dbb1fef13d34d9a6093636cb6a6a5e0
  • SHA512 440480c438ef92b2160b303129ba4a31a7c4637794d4b1437ec6f010ee389b60600d41a6881adec8972fc2d9bb5383b4fa9e8effb99716eca13d2fd5eb9389bf
  • TLSH
    T1C51112A3530555684AC903A5D53DE28AD06A4156D283ED4001FBE511F87606E8FED3E5
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionxmrigmineradwarepersistenceransomwarespyware

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3behavioral4