General
- Target 2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.6MB
- Sample260814-pffftasfpa
- SHA256 1ab2320acf25ccd2e66adf3d8a4bf72b64f3d0a838d6f81ea4aa2679cc4d1df7
Malware Config
Targets
-
- Target 2026-08-14_e3a3ee4c2a98e7ca8e0e25a7eaa582d7_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 3.6MB
- SHA256 1ab2320acf25ccd2e66adf3d8a4bf72b64f3d0a838d6f81ea4aa2679cc4d1df7
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Modifies file permissions
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
3File Deletion
3