Extracted

• • Target
    deepseek_powershell_20260818_66fe9d.ps1
  • Size 4KB
  • SHA256 3aa85a052a028e9adfd5f222d6146dd50ef17eb7b078f17c3f73bf13c54ddc2d
  • MD5 63fc5d1a736c470bc54e771ef7fa1f9c
  • SHA1 40718c24f5b2d93de296d0f394aee6cbc1fa84d0
  • SHA512 f5019f990cd7854a65cc2d8ee77ca499321191bd132c30808c1a78f8dd71c89326bbd983aa6f559ad0f15a3e999799b5353a109700cec105691c84aa1dd35af1
  • SSDEEP 96:fJbTkFw9eV8ZU8xoDO1Mnx+GGgbpaR/uZPrRLkS1//4mzUeQ5jyaxnjlYQBL3wq4:fZqSe8xvKnbYR2ZTRLkEX4gxQ5jyaxnk
  • TLSH
    T195A16306A224A3668BEB1427D5CF678264571037660DAC14709C8BCDBF6CFBDC66B6C3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxmrigminerpersistenceprivilege_escalation

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  behavioral1behavioral2