xmrig | d79e65eebfa27fd486fadee29b39f80e21ce499a01ded902ece56b2486aeb17e

General

Target
2026-08-22_337c56b55cc88706d2dbbada1d845075_hive
Size 8.4MB
Sample260822-e4j4ssvxhs
SHA256 d79e65eebfa27fd486fadee29b39f80e21ce499a01ded902ece56b2486aeb17e
MD5 337c56b55cc88706d2dbbada1d845075
SHA1 e692636ecb4d09416782cecacb51b4ece60b30ee
SHA512 bc3341cdc35aad029a4ff32f3e85d5a198621ef0b880cdf9b2dbc3e778d4b10fc348c5d808ddb62686ce008d2cd3f837b479be7a054ba6b7249215e403cdb017
SSDEEP 196608:f6dqVP6WWVQiiBibAc4wIAyGh6/ETytSroM8fgdE/iA:S0Csi0ibANwIAyBayEV8fAQiA
TLSH
T1CD9633BF50F75D95E61BD2702F909890D77A9D244406993CB682FCEFAF4DA3113B202A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-22_337c56b55cc88706d2dbbada1d845075_hive
- Size 8.4MB
- SHA256 d79e65eebfa27fd486fadee29b39f80e21ce499a01ded902ece56b2486aeb17e
- MD5 337c56b55cc88706d2dbbada1d845075
- SHA1 e692636ecb4d09416782cecacb51b4ece60b30ee
- SHA512 bc3341cdc35aad029a4ff32f3e85d5a198621ef0b880cdf9b2dbc3e778d4b10fc348c5d808ddb62686ce008d2cd3f837b479be7a054ba6b7249215e403cdb017
- SSDEEP 196608:f6dqVP6WWVQiiBibAc4wIAyGh6/ETytSroM8fgdE/iA:S0Csi0ibANwIAyBayEV8fAQiA
- TLSH
  T1CD9633BF50F75D95E61BD2702F909890D77A9D244406993CB682FCEFAF4DA3113B202A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

UPX dump on OEP (original entry point)

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2