xmrig | 6c35a2adf0d25bb58b7afca9417e333c659f6e8715b8c8309bc4ff9e56e4d855

Sharing

Copy URL Twitter E-mail

General

Target
6c35a2adf0d25bb58b7afca9417e333c659f6e8715b8c8309bc4ff9e56e4d855
Size 1.4MB
Sample260804-wbtafaweqe
SHA256 6c35a2adf0d25bb58b7afca9417e333c659f6e8715b8c8309bc4ff9e56e4d855
MD5 7d7913c547a044700641413248157afb
SHA1 c03618a0df93b715c824f81ead72178318bc71cd
SHA512 dd04e9c9f8783b90eee7f59d63e026513c8eff0cbefb4d0e2d1632194f88ee546f02b77d4fd21abfd48388404879d2a1ec3c6f2e1beab90d14965672d25f31c2
SSDEEP 24576:2ykAtqkEzLikVrmtseOolpS1RyNpwBIw+Ix0yTRatkTXWfVT3Y+SHV6xDvCoSj1b:7xqkM+cAsdolpQyAIN6RTRJKVcpHVCLi
TLSH
T1176523E0FC861D81FE2BA3794806D5F3C9E634042FEB036D99E52509B694ED96732CD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  usb driver CH341/usb driver CH341/USB DRIVER1/CH341PAR/DRIVER/CH341DLL.DLL
- Size 30KB
- SHA256 48e025e8d4d3320b273b3a2f029fb33a877ea94ee0a2a7943ee181209fc412a2
- MD5 d84b4c0f270ea6ea91a0ddad53b88c2b
- SHA1 79e54001f70c2833bc14985d1db659a58801d247
- SHA512 92e6701400c230cc3e33e4e810fae9568a05aaf4e12989f516028d03601d5fb0950a662eca061d3f41a734883aa090b78c489e0e5fd7f60e2e1722341da912cc
- SSDEEP 384:dX3mJPDhYdCNMZQHXg8XMpcuMt80acI0m+VkSezswqqNCgd59UNcAFvw6:p3qYdCN3Xg8c10actm+yS/oLAJw6
- TLSH
  T1CFD2F57467CE8D1BE465133488E23BA6F47CECA05A738F861C413C652D77A8B963B712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  usb driver CH341/usb driver CH341/USB DRIVER1/CH341PAR/DRIVER/CH341W64.SYS
- Size 30KB
- SHA256 aed7640e2195f5a52e788844d38b08f906264d2e740bd362db76c241cbb27f7e
- MD5 2e8e48ad2ca64024c20c67c747f217f6
- SHA1 b72e7c6618a85f214b7d6ee3fc7aeae1541897e9
- SHA512 01c824497946cc25fbda3df7e5c38d010b4aa8ced4867d643fc5a9abb2e6ba4a6f47af6fde04ee17cb16f81d04b96e030df52704c9ca4cf833db25b259d26c57
- SSDEEP 384:AdmJz2AbXLmX4wOvRH5GmVaY3cJbr/ZmxOUXEAwfo25rO2KdQxDyTa0mo4OfTyBF:emJyGU4wOvRHUjinEAwfd5083o3fTo
- TLSH
  T158E22993E6E98AB5D16AD232DF544E92EFB07018231427DF918086262576FE0FF3C265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  usb driver CH341/usb driver CH341/USB DRIVER1/CH341PAR/DRIVER/CH341WDM.SYS
- Size 19KB
- SHA256 a3045a4f29a8c86e6fe5af9e5c9225294d266c6218d65bbfcaa5a7d1c683abd7
- MD5 e6e76d443e2925f7ae9d9fbf4255b50c
- SHA1 7b015676e8c4e95bf82455b6e14ad3ee4748fdcc
- SHA512 0d1640b77031749d9b520aa801d9734a7bd9c41176177754de23841a5e948899458fafff6cabefbb8c357e1435248b3afa1f08a35dc1f7c11e5bb832c832e2c4
- SSDEEP 384:ssQeTJ1C/0kXll74neTi90iXE5JIfreHM3FJR3V7z:VQh0WLfuPXw6frL97z
- TLSH
  T1D8925E81E1878CF3DB4989B0155A77B7613F17222216A6BF83BCCDAC0B1F261BF25125
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/CH341串口驱动（备用）/DRIVER/CH341PT.DLL
- Size 6KB
- SHA256 45494ce819c1b5c21abb72dc47a0ca36807e0ed74ce55b631da174c77a9b24db
- MD5 69b6fec924c30042d329ae56ca8925cc
- SHA1 54e8d7d9004c8c819fe2e8bf7a1306bcbdd5ecbf
- SHA512 a6bc866712c2b6d2ec115341de6ec5b352505fff159af967b03d27ad767164271f147780639e836a4da54f4b2b688591edf1374802cb5f7340062aee9b341abc
- SSDEEP 96:UeIX+tip7uemP4I3bYFE6H6IyYrL9Cu6d0CGeSG4qb6Yiigx9BGWsy:Uegda4Irx6HhGLbqig7Lsy
- TLSH
  T17AD1436377A85D6FF0FB0378D4D32B17F2BCF45047334A8F4AA002526E246536932A92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/CH341串口驱动（备用）/DRIVER/CH341S64.SYS
- Size 57KB
- SHA256 a4fcde254d367e9c469bf0bd0dbf9770916cf5cf14770722e62989727e526b65
- MD5 37c29f723a1174b21e7cc6e66d7c2c37
- SHA1 9d233c3d58213dcb52d1e06a99f95ab424ef8991
- SHA512 8ce91e574d8dbbf1864d743a907e00a24f72244f40eb7bdf8fc84745c67a27c05e273289e26a4e856cfe7220653eef331107ae0955fd9a25a874277ed06aabb2
- SSDEEP 1536:ckXPh73gmu5qacLjgZqeV3q9TiIVve2Cv:cm73a5qNeV3qP22G
- TLSH
  T1C5435CC29AA9407AD2A3C131C6360BA3E779B4482715C3CF50E186285D97FE4BE7D771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/CH341串口驱动（备用）/DRIVER/CH341S98.SYS
- Size 19KB
- SHA256 0ecd1222627271ea31d3b64796992b6daf5133d64cc26d43b3873cbe32fd59cb
- MD5 b6f4a83911336e84bead8f8905285fab
- SHA1 983786502f45afb946f023d73e32a31bc1bbb91d
- SHA512 93e949ea7cf067e1cec52f6dde8678fc7bceb2e947164040a087fdd63e799cc244eb6974323fc836f70ae777a67e9660f4e9e2dbb42dc0c4b099b1c2be168964
- SSDEEP 384:3P2ie5TwxdKe9Vk5DT6Im2ULzQFAQOCsznlUt+3x:OiesSVTZm2ULz4A27wx
- TLSH
  T157924C52B76904F3DEC37F7488BA3379633B963422215BA36378C4E50D5F241B906E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/CH341串口驱动（备用）/DRIVER/CH341SER.SYS
- Size 38KB
- SHA256 0f74725ef943f940114762558d2ab9bd16e35d38228dcc59f68debadc1eab3b1
- MD5 a3e467ef4a30ccf8ae674ac879cc56fe
- SHA1 c56a621abebb4ca05cf6538cfb199f830cfebb76
- SHA512 808e877dbda0ad5c4fe8a17fb1df32deb5a92108c7bc0724446e024e148803cea917f624953a343a346a07a446be5fd3b559ec59d18792f96c62e31f8e8e728d
- SSDEEP 768:Hx3sx1MsLLMupyr8ALYyR2UUA+YNgpY07IKDY:H1sxisFSLr2Y+YNAYjuY
- TLSH
  T11A035BC6779408F3D987DB78A12A3376933B9E7A06C15B935379EA642C25311BD032E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/CH341串口驱动（备用）/DRIVER/SETUP.EXE
- Size 240KB
- SHA256 a0bf4dca68f7cf2e115844b0b1a4669c04b46f63b721b8b9645382b1b1b24db0
- MD5 d529ee231db01f2adb637412584a6e03
- SHA1 b0c150ebd6350327b1a9aec3f923f29932fe50ef
- SHA512 caee337fb4c52887eef8b53339d31e433a4ca501a70754818cb2f1403e7a316c355bf7b50ff2b44e286a4f8b9ce6ef1a60af95925ab702861c2de71b522d3c79
- SSDEEP 6144:z15SdMO2UDbMSfk8qEHG2myLYmakTPB54O1:znSLxDbfRq2PLjakzBV
- TLSH
  T1D5340207BBC988B2FD9612B91167DBB3CF7A210807162B87AF54C9775433070DB2BA56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan upx
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Drops file in Drivers directory
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/CH341串口驱动（备用）/INSTALL/模块调试.EXE
- Size 316KB
- SHA256 fcf921cd7145ccf5c00549815769aad0f310805c4871180ed689ef4400c0d04c
- MD5 7d647432c60c6313f7ac26a4bfadf5ec
- SHA1 9dde77ec695bd0007e802265f79cc5105b89126e
- SHA512 ba731dd89d6d9afa2bddaad5023737653b35dcc51bdd62e69b2b10f3c9716f2c29fd9b54d889453748907be404450daf74a1623695d2f4f639012edad5abca5d
- SSDEEP 6144:0Ds51JPdN4LR/QkeoVcM3N3ukjAKRlpPNwPdqCxrJzETXs4qR9L:0W1JEOkeOp3N3uiAKRlpqqCxrJn/R1
- TLSH
  T18164C002F75A1647DEB681311DD301B04C63F08E2F4342D6B3DE11EB57BAD9A98ADAD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan upx
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Drops file in Drivers directory
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18
- Target
  usb driver CH341/usb driver CH341/USB DRIVER2/DRIVER/Windows签名驱动，支持win7（首选）/CH341PAR.EXE
- Size 354KB
- SHA256 189e73cd52a34bf959c5d6de6dfda268f1bde4ec2473ff5d77cfe128d2dc2c09
- MD5 0f9a9cae59f79b2b02c3badf413656e9
- SHA1 903ffa9b06ef6fb169f505e8f704dd47dc07f564
- SHA512 261dae44e8ebe4a83dc598c2661aad2ee59f3f5844e6dcea6d7bc640138a283f3a30158c3566820c841661937efbae4f3a74473f397ca6195234e81287e3333e
- SSDEEP 6144:P8U2qy6rRZb7jxGY4VJT6fNtwycAYnQIIPdlrm6GybKiicAX6shdGPIVG1cYqiiX:7zy6rRxEZ2wH3nKwyGiNAXl0IV/YCl
- TLSH
  T1E1740118B68681F3C4004B70489D73B7DA39FF256B60A35ED7AA9E587C38B42741DEB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery xmrig miner trojan upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Drops file in Drivers directory
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20
- Target
  DRIVER/WIN98/SETUP.EXE
- Size 56KB
- SHA256 1fb0d435a6e6a60e2f66c29d6562ff4bb974f5e4df78545b655f11b49bb04b23
- MD5 34bc90fa25e826c36df9481efaec5589
- SHA1 cc86433948aecd8c0a74a390d22c601fbee66b3e
- SHA512 7f506884e77f22453368f158d02bea3440cbd4fe154623b3b48ec67d023a3169586124123290384b7ee8dfadbf3777dab076c4b71e1f02dfe948a2af048cdb22
- SSDEEP 768:O9KpAiVsiL6NOhl0DDCh2XsHv/i8t80H1kHNKLlh6oKjE:BAzC6NOhVwsHi8t8M1KcLaoaE
- TLSH
  T1C7437D837CC488B3F861417106AB4BB3577B7518072B9BC79B64E95D68336A09E3B383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  DRIVER/WIN98/USBMON.DLL
- Size 12KB
- SHA256 7975dc89732ec8792a08a0a70a4938bdab611c834dca94be40aa021c2ebcafcd
- MD5 c0f6e64036e609d2326d045c497d695c
- SHA1 32a3a75c1826f043bbc4f226011702f8109a9eec
- SHA512 b1c907cc66ef5ec0331125b2416d27b891a5787c529e51bf265fd6696e1c2a63b393afdcf29773cb4ef763888bbfcc00444f2822d67071b5be6190344648c0be
- SSDEEP 192:Fwgl3KWhp6UjjxCganrjPhnhXzTbsbF26D0eCocErq202rw5QWalWnX2:Frz6UPxCgEhXzcbEe0exrqJ21WalWX
- TLSH
  T19A423B51F2F95CFFF8E71B743BA736196128DB881A46D65294B85CA92C261408E3C732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  DRIVER/WIN98/USBPRINT.SYS
- Size 22KB
- SHA256 baa5c4701fd612f961741b9685543e133b6d4f091b51b335abb63a566744a2cd
- MD5 bdcf7f43abd107e8f7d31d78c1b096a8
- SHA1 bcfcb1bf660a745d36617ffe87fc0606afb576d0
- SHA512 93a707e1867781e53a644a9f80739301d8292936c249bd26ec006d4f8b7f3d4061f58ca3582b4612740392f98b2443e0bb1e2acade58fa8a06991780a6ef85e0
- SSDEEP 384:pdL3g0t0K4cfu5+DG1VPDTTI1duegVXT1JStv6WSBlWXdZuQY:ng0t0OPqVPDTTIXueeXRlmdAp
- TLSH
  T166A20910F204A41DD5EB56FED83A65A99527DF8D03055ACF0AD81CCA5F2E8DA3E3047B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  DRIVER/WIN98LPT/CH341P98.SYS
- Size 20KB
- SHA256 f9f177a6fef4dfdb230de29f5d589f2437d58c768f52fd8a66a5932a5ad0528f
- MD5 c584fc10f5240e46e99afdecb30c0fbb
- SHA1 af2be25670d67ad41241d15d770af95ac34cc782
- SHA512 25e61dd6bd1486045eb992af13f36cd83341837fa59eac709be245ab4d7c25c9eed01677fc8b619530a836bd45a35446dfb841a6829885dd49a1931fac8afab2
- SSDEEP 384:6DykrB4MpVcUyAlFlKGw1Uh/hTAQQV8NMHeRPU62KawUaM9e3Vd1/WK:yykV4AZzFnNMg4KEeEK
- TLSH
  T100A25D02F7AE05F3EAC3A67408A7337956376A2D132756A7533CC8F4592E200BA15E37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  DRIVER/WIN98LPT/CH341PT.DLL
- Size 6KB
- SHA256 45494ce819c1b5c21abb72dc47a0ca36807e0ed74ce55b631da174c77a9b24db
- MD5 69b6fec924c30042d329ae56ca8925cc
- SHA1 54e8d7d9004c8c819fe2e8bf7a1306bcbdd5ecbf
- SHA512 a6bc866712c2b6d2ec115341de6ec5b352505fff159af967b03d27ad767164271f147780639e836a4da54f4b2b688591edf1374802cb5f7340062aee9b341abc
- SSDEEP 96:UeIX+tip7uemP4I3bYFE6H6IyYrL9Cu6d0CGeSG4qb6Yiigx9BGWsy:Uegda4Irx6HhGLbqig7Lsy
- TLSH
  T17AD1436377A85D6FF0FB0378D4D32B17F2BCF45047334A8F4AA002526E246536932A92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  DRIVER/WINME/SETUP.EXE
- Size 56KB
- SHA256 1fb0d435a6e6a60e2f66c29d6562ff4bb974f5e4df78545b655f11b49bb04b23
- MD5 34bc90fa25e826c36df9481efaec5589
- SHA1 cc86433948aecd8c0a74a390d22c601fbee66b3e
- SHA512 7f506884e77f22453368f158d02bea3440cbd4fe154623b3b48ec67d023a3169586124123290384b7ee8dfadbf3777dab076c4b71e1f02dfe948a2af048cdb22
- SSDEEP 768:O9KpAiVsiL6NOhl0DDCh2XsHv/i8t80H1kHNKLlh6oKjE:BAzC6NOhVwsHi8t8M1KcLaoaE
- TLSH
  T1C7437D837CC488B3F861417106AB4BB3577B7518072B9BC79B64E95D68336A09E3B383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies firewall policy service

UAC bypass

Windows security bypass

Drops file in Drivers directory

Executes dropped EXE

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

UPX packed file

Modifies firewall policy service

UAC bypass

Windows security bypass

Drops file in Drivers directory

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

UPX packed file

Family: xmrig

Modifies firewall policy service

UAC bypass

Windows security bypass

XMRig Miner payload

Drops file in Drivers directory

Executes dropped EXE

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32