xmrig | 46f5a58bbd141bbc77a2220a8ce29aa742373f72e8c89b06238c8e3e71898238

General

Target
2026-08-18_933d611bbf8af774f155d2c3189d6ff7_akira_bazarloader_glassworm_ngrbot_quasar-rat
Size 5.2MB
Sample260818-hd1weaxfrc
SHA256 46f5a58bbd141bbc77a2220a8ce29aa742373f72e8c89b06238c8e3e71898238
MD5 933d611bbf8af774f155d2c3189d6ff7
SHA1 d56d72754c8f2158e6afeba68c6dfd5b92cfaea3
SHA512 afb08af61d0edd71261bda8d29ff32a4ff96c599759cb00b5f972f28b3eef16eb9fbd52a4aa698c24c3d09a2596e6c565d1bf8f2e8e4330a04829216dca2462b
SSDEEP 49152:+csdMbEIVyhuB51+bDqcUVMWMcYS4RvoKByHTbLiKnvpeyxW9UitztzjiTqf1q7a:+1envMBcYSuRgoe90+9C
TLSH
T1BE467D43E29590E9C06EC079935AA733FA72B8CE0538B65F5BD4DB212F61F50A70E718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_933d611bbf8af774f155d2c3189d6ff7_akira_bazarloader_glassworm_ngrbot_quasar-rat
- Size 5.2MB
- SHA256 46f5a58bbd141bbc77a2220a8ce29aa742373f72e8c89b06238c8e3e71898238
- MD5 933d611bbf8af774f155d2c3189d6ff7
- SHA1 d56d72754c8f2158e6afeba68c6dfd5b92cfaea3
- SHA512 afb08af61d0edd71261bda8d29ff32a4ff96c599759cb00b5f972f28b3eef16eb9fbd52a4aa698c24c3d09a2596e6c565d1bf8f2e8e4330a04829216dca2462b
- SSDEEP 49152:+csdMbEIVyhuB51+bDqcUVMWMcYS4RvoKByHTbLiKnvpeyxW9UitztzjiTqf1q7a:+1envMBcYSuRgoe90+9C
- TLSH
  T1BE467D43E29590E9C06EC079935AA733FA72B8CE0538B65F5BD4DB212F61F50A70E718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects command variations typically used by ransomware
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many IR and analysis tools
- Detects executables referencing virtualization MAC addresses
- UPX dump on OEP (original entry point)
- detects Windows exceutables potentially bypassing UAC using eventvwr.exe
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Contains code to disable Windows Defender

Detects command variations typically used by ransomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing many IR and analysis tools

Detects executables referencing virtualization MAC addresses

UPX dump on OEP (original entry point)

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

UPX packed file

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2