xmrig | 44c25a9c3273c4281239c228eadca24a5f6c138621c5fb698e1539439f43d6ba

General

Target
44c25a9c3273c4281239c228eadca24a5f6c138621c5fb698e1539439f43d6ba
Size 3.6MB
Sample260819-dasneaxvbz
SHA256 44c25a9c3273c4281239c228eadca24a5f6c138621c5fb698e1539439f43d6ba
MD5 a529385e99e3e98954e93e6a8a525772
SHA1 fda2ccc79fbe3bf47d288020d0f5444f064d1f72
SHA512 3a89c52088bda84ed2f8d0106eac8536b877b97fdb5c4b10deeaf1defc9cc68bdf2888c7663483c927e91eba136e4a86454288e04facf6116c770039db68ce27
SSDEEP 98304:C4D9d9+YeS2hGBx33ylyfHoKSxrJPBkOwX4jCJM:C4xb+YeJUB531fHoKSxrnkOwX4L
TLSH
T1A1062359A5AC5EFCE867C6398D420945C762BC5D8360EEEB03E045A70F77A908E3DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  44c25a9c3273c4281239c228eadca24a5f6c138621c5fb698e1539439f43d6ba
- Size 3.6MB
- SHA256 44c25a9c3273c4281239c228eadca24a5f6c138621c5fb698e1539439f43d6ba
- MD5 a529385e99e3e98954e93e6a8a525772
- SHA1 fda2ccc79fbe3bf47d288020d0f5444f064d1f72
- SHA512 3a89c52088bda84ed2f8d0106eac8536b877b97fdb5c4b10deeaf1defc9cc68bdf2888c7663483c927e91eba136e4a86454288e04facf6116c770039db68ce27
- SSDEEP 98304:C4D9d9+YeS2hGBx33ylyfHoKSxrJPBkOwX4jCJM:C4xb+YeJUB531fHoKSxrnkOwX4L
- TLSH
  T1A1062359A5AC5EFCE867C6398D420945C762BC5D8360EEEB03E045A70F77A908E3DB13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Cryptocurrency Miner

Executes dropped EXE

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2