Extracted

• • Target
    deepseek_powershell_20260817_33ae63.ps1
  • Size 4KB
  • SHA256 bc610b668b684bd249670da640c8fb30083408836e288982a088ee7823838ded
  • MD5 8184e636b9967060bd8c0498640370bc
  • SHA1 06b04521119e3ae83d3d7cf8334c7950afc9cd80
  • SHA512 5eb8ee660202d6fbeac73d2a9ccabfc6b35c20d702e83a00b6cef863efc3080d536b583b05d65ced0047abfeff2aebc9905639616daacca32a44d6865786f9cd
  • SSDEEP 96:qJFTkFw9Akv8ZUQOqoD1UMnu+GGRD0w38/zNYMRLJaZ/8ImPUeQLyaxnjlYF+MEe:qrck0eQfWBnxb8LNBRLJMkIUxQLyaxnw
  • TLSH
    T145A1211AE27993619BDF5427A5CD53435C8700372605AD2430ADC6C97F68BBCC7AB387
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxmrigminerpersistenceprivilege_escalation

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2