xmrig | d6a2d7eb003af4056c35b975145a90382bfb08e19239aeaed6a3f9ae1e9ab291

General

Target
2026-08-08_092fd5fdc993f3058a68f8ef1d46b66f_cryptbot_icedid_luca-stealer_njrat_stealc
Size 101.6MB
Sample260808-xq7xtacm3y
SHA256 d6a2d7eb003af4056c35b975145a90382bfb08e19239aeaed6a3f9ae1e9ab291
MD5 092fd5fdc993f3058a68f8ef1d46b66f
SHA1 7cde643782bcfb355411a58a9b62f01c240177e1
SHA512 a063e118331497e38672e0f2467c6abf9fbc4e9b3f634629111034411e05f6af6c1cb630c08d31f02bd669f43a9dde620232a17a2d698b72efe5d03fa4a7d22a
SSDEEP 3145728:vqYkqCZHdMFghnj/PQicze9sTt0zd0V1Qe2qd5gL:vZkTdMMPOemTkSJy
TLSH
T10C3833739AE06C52DE6BF7744ED211039762B09C92A3C18F14B9A5D06B9728487F6F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_092fd5fdc993f3058a68f8ef1d46b66f_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 101.6MB
- SHA256 d6a2d7eb003af4056c35b975145a90382bfb08e19239aeaed6a3f9ae1e9ab291
- MD5 092fd5fdc993f3058a68f8ef1d46b66f
- SHA1 7cde643782bcfb355411a58a9b62f01c240177e1
- SHA512 a063e118331497e38672e0f2467c6abf9fbc4e9b3f634629111034411e05f6af6c1cb630c08d31f02bd669f43a9dde620232a17a2d698b72efe5d03fa4a7d22a
- SSDEEP 3145728:vqYkqCZHdMFghnj/PQicze9sTt0zd0V1Qe2qd5gL:vZkTdMMPOemTkSJy
- TLSH
  T10C3833739AE06C52DE6BF7744ED211039762B09C92A3C18F14B9A5D06B9728487F6F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig impact miner persistence privilege_escalation ransomware
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2