xmrig | 5bc259718a6b5df993f3538ddf563bb7da8d30121ac113c8b3fd0449b6070c69

General

Target
260822-ym4awsydrh_pw_infected.zip
Size 3.9MB
Sample260822-ysbstsyemb
SHA256 5bc259718a6b5df993f3538ddf563bb7da8d30121ac113c8b3fd0449b6070c69
MD5 9ac51ec415ad3bf5771604604e4a0377
SHA1 f4fc92ec7eb5fd1e32b03f9093738da44f529f1a
SHA512 615ef1ca0a762a77c58c4137b7a03c398f7ec1da4eacf9a90b6cef045eca3d9e93725aa2278ab861026b410d5f77765bf070861b07f273b1e75ee52e3c12235f
SSDEEP 98304:DqAcZj98Q82GoRAZCunv7eaNvr87UL3ZBb5jZ:D698eqZCwy+r87MZ7Z
TLSH
T120163356A019843DB76B57E53374D9F7E1226228307E8FA4453CDC783EEA8334AE5472
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  260822-ym4awsydrh_pw_infected.zip
- Size 3.9MB
- SHA256 5bc259718a6b5df993f3538ddf563bb7da8d30121ac113c8b3fd0449b6070c69
- MD5 9ac51ec415ad3bf5771604604e4a0377
- SHA1 f4fc92ec7eb5fd1e32b03f9093738da44f529f1a
- SHA512 615ef1ca0a762a77c58c4137b7a03c398f7ec1da4eacf9a90b6cef045eca3d9e93725aa2278ab861026b410d5f77765bf070861b07f273b1e75ee52e3c12235f
- SSDEEP 98304:DqAcZj98Q82GoRAZCunv7eaNvr87UL3ZBb5jZ:D698eqZCwy+r87MZ7Z
- TLSH
  T120163356A019843DB76B57E53374D9F7E1226228307E8FA4453CDC783EEA8334AE5472
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig
- Size 9.8MB
- SHA256 3939817a6e82b672cfedcbe5c6ad3c643bd1008e784e89505f8af9e1365b1ce4
- MD5 01b13eaed23b6e2abca1b24f3e9ba3a5
- SHA1 b43c69484881fd1c72a061d95eabfbb0a2c09278
- SHA512 a449d428c001fb8ff57c3285889c7984d3facd2ed20a721893198aa868529593b6c8c961c365ea3c9b6a40a4a51ecfd9d2966b695fffc0da15a04ed62733baba
- SSDEEP 98304:dZjWJmVrVMM6fZgItSLXlfEQ502MSQeVlIonoOvv7NpF8K:dZjAmVrVMM6f+h50moOvv7Nr8K
- TLSH
  T1A4A65C17F8A704FAC6BEE13485929322BA72345543317BD72F94466A1B27FE47A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence command_and_control xmrig miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Contacts a large (1819) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Stops running service(s)
  defense_evasion execution
behavioral3 behavioral4