xmrig | 06677422fd399a4c66d4e6685a0855075594c1806f9b845fb5f87adfbd984d23

General

Target
2026-08-11_1a10380ab4c48d52f5be84fdef932281_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 20.8MB
Sample260811-ebrm6scc94
SHA256 06677422fd399a4c66d4e6685a0855075594c1806f9b845fb5f87adfbd984d23
MD5 1a10380ab4c48d52f5be84fdef932281
SHA1 d883bd92483eff4d07dff8f3c3859f92a9381bff
SHA512 8eb2707033531d79c19594ed18e251e5dc850c78c0fffe4aa6b3a52c689098ea9ea954e557a3727dfd715e51532777e2a860ee2f87d73df30230e031568fa54e
SSDEEP 393216:QocbnMjYLbxvGtXy83MIfdRqkBLbibdQZPqH2Y5hF3MnG3VaxgyLaX5:hiMjYfxvH83MIfdRDBqbdQZ433MGlaxg
TLSH
T1BD2733597BC40DF9F473A23EC103D868D3327E1697A5CB5347E082A21EA72942E7796C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-11_1a10380ab4c48d52f5be84fdef932281_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 20.8MB
- SHA256 06677422fd399a4c66d4e6685a0855075594c1806f9b845fb5f87adfbd984d23
- MD5 1a10380ab4c48d52f5be84fdef932281
- SHA1 d883bd92483eff4d07dff8f3c3859f92a9381bff
- SHA512 8eb2707033531d79c19594ed18e251e5dc850c78c0fffe4aa6b3a52c689098ea9ea954e557a3727dfd715e51532777e2a860ee2f87d73df30230e031568fa54e
- SSDEEP 393216:QocbnMjYLbxvGtXy83MIfdRqkBLbibdQZPqH2Y5hF3MnG3VaxgyLaX5:hiMjYfxvH83MIfdRDBqbdQZ433MGlaxg
- TLSH
  T1BD2733597BC40DF9F473A23EC103D868D3327E1697A5CB5347E082A21EA72942E7796C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit xmrig miner persistence pyinstaller
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2