xmrig | c4f7d0c72fef577b60fb6bad87ca3b3a1d96d165059f4c1ab235298e894967af

Sharing

General

Target
slinkyzip.zip
Size 1.4MB
Sample260806-sfrevsdq71
SHA256 c4f7d0c72fef577b60fb6bad87ca3b3a1d96d165059f4c1ab235298e894967af
MD5 b3848111b207bc5aafe065e9c7afd0c4
SHA1 279a6889b45a64cf33d878539e352c5750600578
SHA512 0a6f4615888b83c5632a4d706c07c81ba1aba631fd422c571db4a4b51acdc5b2cedcbe9fe9bd0887280f32d126a872ff55dfa3080587e0a0ce1f8b033550a1b7
SSDEEP 24576:IfdF9qBMMh0P4or7u9srJ8p/jTWD4Mtb6Pq1W2O15eFPMfs3HgTNbxj1zU:IfYr9cuaA/jA4Ob6YNO7eFPMfqHKNbxe
TLSH
T161653318DCD7D2708F9BF7734F964A0E620C76C8EB229BE81BA3F46167354566897830
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  slinkyzip.zip
- Size 1.4MB
- SHA256 c4f7d0c72fef577b60fb6bad87ca3b3a1d96d165059f4c1ab235298e894967af
- MD5 b3848111b207bc5aafe065e9c7afd0c4
- SHA1 279a6889b45a64cf33d878539e352c5750600578
- SHA512 0a6f4615888b83c5632a4d706c07c81ba1aba631fd422c571db4a4b51acdc5b2cedcbe9fe9bd0887280f32d126a872ff55dfa3080587e0a0ce1f8b033550a1b7
- SSDEEP 24576:IfdF9qBMMh0P4or7u9srJ8p/jTWD4Mtb6Pq1W2O15eFPMfs3HgTNbxj1zU:IfYr9cuaA/jA4Ob6YNO7eFPMfqHKNbxe
- TLSH
  T161653318DCD7D2708F9BF7734F964A0E620C76C8EB229BE81BA3F46167354566897830
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  slinkycracked/VCRUNTIME140.dll
- Size 83KB
- SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
- MD5 1453290db80241683288f33e6dd5e80e
- SHA1 29fb9af50458df43ef40bfc8f0f516d0c0a106fd
- SHA512 4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
- SSDEEP 1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
- TLSH
  T169837D4577E402BAE06BD074C0A29E47FB72B585873047DF036996AE0F53BE24E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  slinkycracked/VCRUNTIME140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH
  T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  slinkycracked/glib-2.0.dll
- Size 1.2MB
- SHA256 29f281e0e9ebc9cc7b54af08535509feac1930a60d3d2e2fe9528f77711f04a8
- MD5 74801ead5a1402af905efa4ca76fd181
- SHA1 b08eb2362170048a7b0c08a6339cbf29001fc8c9
- SHA512 9c6d3c2ea2ec6025da828ed4d5688287f6195ba5f999288655430c09379ecf7165dd26c483620cea703c8db7cc796fc98cfc532904188ae413b910f167e659f3
- SSDEEP 24576:Ta0mJzYXgexdLNoLpRimUKr+h5gmYFA+NILwVtvM0E:TaThYXgexdMbimUKrrmYFAsSKtv+
- TLSH
  T1CA452755A64539A7FB9ACC7588A19353E27074080F2366DF3E6CC6291B2FBD7023AF05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution spyware stealer defense_evasion xmrig miner persistence privilege_escalation
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Windows Firewall
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral7 behavioral8
- Target
  slinkycracked/gmodule-2.0.dll
- Size 29KB
- SHA256 ed105b46d3a374db93cc79ce058e897b63dfce9bcc3a27d93ab8f254baeae58a
- MD5 a45eea5bcdd017b9c4535f5c7daaf2df
- SHA1 e25337dd0c49784566a4d83f71130a18704dbcb9
- SHA512 0ce56d630456ca4a91a628ca9729b152dbacc6e2a33b150011715d6a45b8e7512da422d804c13afa4fbd5935e1d42a3efbace43f5c6826c1acf9e053b13f2ab5
- SSDEEP 384:GXlf1IXxPE2Q+FoFR0dRpDhj3aKuqHuej+IYiBpxaV1VF0hXHMGBk7/UMQ3n:ugOR+6SDhb7uAnYi3YV1VaXLkji
- TLSH
  T1EED28D436B5450D7DA05CD7CE8E3A907EDB5B2C08BD152CF2229C6580F263C27BB9768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation spyware stealer
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Windows Firewall
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral10 behavioral9
- Target
  slinkycracked/gobject-2.0.dll
- Size 293KB
- SHA256 2c76ddda266dbada9597eec8d7559b0669c25f2037344c19b4807e4d61b6dcfe
- MD5 103bf98f16d5dda06336b3f0f10bb979
- SHA1 693aea2e2e97ff1c029066aa2440d01b7792c68a
- SHA512 949638780a315efb8229f01fd9fad365ec5fe393d3d66cd1fe4676224b18e38b6c02347827c9551e23b12e2a742f16aff1762fb942c27f07484d13bd90884695
- SSDEEP 6144:KazHASmQbLH5T279peOal8JcrL+H+dCnI8XiuPqlcKHXQvUkC:pzHASjH5TG9peH8JcjqikKPF
- TLSH
  T1DB544A5D72986C69EE6BC038C652D507D2B274011362A7CF17B083AA1F37AE5F93E706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral11 behavioral12
- Target
  slinkycracked/intl.dll
- Size 109KB
- SHA256 300d00cc110e0ccc17e74599de80076085a58741fe73772ef6fcb0167c0d64c5
- MD5 250e0703d15cb9896c6ca786164232db
- SHA1 9df9c86469e912d1c28454bc5853003be287806b
- SHA512 c601793db793121ff2efde2215a6fc8eff545f65f1fa968ae40294877d24260682281b7e8a08fa1b998fbb8551eb97988436e7076968a00ecbd7b247a1a916b9
- SSDEEP 1536:ZPJlpPpUI1cuSvOKtUDLH1OF/y0uwmb7AOrKWzqgTYrP3nWWkDKpFCMpPzKfm:n3Z1i+kK0DSAObqgYWwpFCMp+e
- TLSH
  T16DB30247E9E252DAC986263E0A879F61E965BE30479113E33531F02E1EF1AD42CF9570
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  slinkycracked/pcre.dll
- Size 402KB
- SHA256 67332a8c1fa3a2bb449aea74cbcff3c64754fafb09c273ae51bafac91deac340
- MD5 caa517b0b14ff77ba93fd1cd7d8d7d2a
- SHA1 4e5122369d4e7386bb29f68d876395ea35b13273
- SHA512 cc12dfb4ed69cc202d821209fc28506839f37af1d04414f4b1da9b3b5bf43a733a2c73c24d7f2be1bd8244da9eb9b570aef16129c91ea1a788de36106f9ce015
- SSDEEP 6144:hcfa25CGe2eaYPo6O7lyD+cycOM6BdgWrLNfpui:/aY9O7ePy5dgWrLHui
- TLSH
  T15894490163B504B8FFEBE1374792D112DBBA312853B78DAF25D0AA70BA32771067E519
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  slinkycracked/slinkyinjector.exe
- Size 98KB
- SHA256 be988c2a54aa46883cafdfb6068e3b77be09dd054aa117f49b7b9e90d324e76f
- MD5 d4dd4c8ee2c4642992f77732bc3852e1
- SHA1 2f089ed5670d93fed6a485f40dac750bb08e559a
- SHA512 6b7e7c2d97f312217ce4f493436e11d4cb59c21c65e2c9f70360f80813a475ccd147795386710b9afe7d25ebebda8008909d83b787abbd29300387ba9fbe4af0
- SSDEEP 3072:xPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osWFngD5PxzU:xnvuLxqR8Aahz91os4nMlU
- TLSH
  T14BA34A4AA3D800E9DCA181B8DA725213E3B1B148576293DF0725C2590FB7BE57F3A398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution spyware stealer defense_evasion xmrig miner persistence privilege_escalation
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  slinkycracked/vmtools.dll
- Size 867KB
- SHA256 dbee15d75e4bfc40a0091878009dedf0cca795f224554c91ad776710eb3a76a9
- MD5 7cf6a1b39eab16a9954386d05e296e62
- SHA1 07fa47bfeae938638fa7e37bef82f6d15b028349
- SHA512 2266dfed3ffd8abac71dcff197cc44cfa94be42c1c26ecc4f6531200ee28bdcfede3a1ca2e7329f3adcac1aa98e2081b25c8ed5418789df6ee81b5066b76f939
- SSDEEP 24576:mjn9BE4lOtZD6/kdhiAMHVDapqhSgIEINmVn/t:mxBE4lO3Zdhi40hSgIEEmVF
- TLSH
  T1E0158E5AB7A902A8D47F8139C5579322F7F0B8140321A7CF1665D6696F3BFD2223EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer command_and_control xmrig miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies Windows Firewall
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral19 behavioral20