General
- Target 2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig
- Size 13.2MB
- Sample260823-b945da1gra
- SHA256 427b4808ae042932f399868ad3fc2a23b567898250a552cbc0d2fb66dee40389
Score
10/10
Malware Config
Targets
-
- Target 2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig
- Size 13.2MB
- SHA256 427b4808ae042932f399868ad3fc2a23b567898250a552cbc0d2fb66dee40389
Score10/10-
Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.