xmrig | 078ad1c707763be68f439d5a676b58707713c48e93f33c5eb01623a18ba34a73

General

Target
2026-08-21_63432c905a30993f8b2c44fa77b98c83_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_poet-rat_sliver_snatch_stealc_vidar_xmrig
Size 7.6MB
Sample260822-rbk7lsvenc
SHA256 078ad1c707763be68f439d5a676b58707713c48e93f33c5eb01623a18ba34a73
MD5 63432c905a30993f8b2c44fa77b98c83
SHA1 ae757b52f2c964d813094d8cd8e76eaf2af8ac8e
SHA512 a338cdc6743436bfe08e1c8bfa42f53a009d1e94cf8d4fbe79b43978039421b0248c7c59614e1416993147751ab72a9a9d3043fd53c9aa5db01fe48c7da74cf7
SSDEEP 196608:RNCZi4pgMWCZgJvwKtTrYP7GILBqMFE2844DYIv8ZFbImQpRTUsliOw8:m8e98vwKtTrYSILBqMFE2844DYIv8ZF9
TLSH
T125868D90E99F00F5EB074431889B533FB730390A9334DAC7DA541B9AFA276E14A77762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-21_63432c905a30993f8b2c44fa77b98c83_cobalt-strike_coinminer_elex_glassworm_icedid_njrat_poet-rat_sliver_snatch_stealc_vidar_xmrig
- Size 7.6MB
- SHA256 078ad1c707763be68f439d5a676b58707713c48e93f33c5eb01623a18ba34a73
- MD5 63432c905a30993f8b2c44fa77b98c83
- SHA1 ae757b52f2c964d813094d8cd8e76eaf2af8ac8e
- SHA512 a338cdc6743436bfe08e1c8bfa42f53a009d1e94cf8d4fbe79b43978039421b0248c7c59614e1416993147751ab72a9a9d3043fd53c9aa5db01fe48c7da74cf7
- SSDEEP 196608:RNCZi4pgMWCZgJvwKtTrYP7GILBqMFE2844DYIv8ZFbImQpRTUsliOw8:m8e98vwKtTrYSILBqMFE2844DYIv8ZF9
- TLSH
  T125868D90E99F00F5EB074431889B533FB730390A9334DAC7DA541B9AFA276E14A77762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Contacts a large (35707) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2