xmrig | d358905bd50faf80cd81d8e0aca0df4ff1b6ed4b341c208c05cd9a4608275fc0

General

Target
update2.ps1
Size 6KB
Sample260826-slfkjs1ekc
SHA256 d358905bd50faf80cd81d8e0aca0df4ff1b6ed4b341c208c05cd9a4608275fc0
MD5 b195886c009f899d5b01998c56949b5d
SHA1 05afb1137b65ec2f834ef4a8c3dc6c577c7d7be5
SHA512 0d779efaa7ee0ae3e2e4a91b72db72d5862184afa1e838584e7f23fedc9442b3ecc03bab712430ba5c5f5de8a3a5d213e08234c194029c519482791442bee83f
SSDEEP 96:TEMnToFyOlPt1zldsIN03YQNCSfGAdVUYIu6eTgwkx7psu2Zhc17FAWNHTbOThR3:TEcUjlPnzldA3zvfPbTgpl3BpAWBXOn3
TLSH
T16DE1C2AA41C78E348C53DF3274C19C765771B0FDDD21582319A4BED8DA43A55A49F380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  update2.ps1
- Size 6KB
- SHA256 d358905bd50faf80cd81d8e0aca0df4ff1b6ed4b341c208c05cd9a4608275fc0
- MD5 b195886c009f899d5b01998c56949b5d
- SHA1 05afb1137b65ec2f834ef4a8c3dc6c577c7d7be5
- SHA512 0d779efaa7ee0ae3e2e4a91b72db72d5862184afa1e838584e7f23fedc9442b3ecc03bab712430ba5c5f5de8a3a5d213e08234c194029c519482791442bee83f
- SSDEEP 96:TEMnToFyOlPt1zldsIN03YQNCSfGAdVUYIu6eTgwkx7psu2Zhc17FAWNHTbOThR3:TEcUjlPnzldA3zvfPbTgpl3BpAWBXOn3
- TLSH
  T16DE1C2AA41C78E348C53DF3274C19C765771B0FDDD21582319A4BED8DA43A55A49F380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution persistence defense_evasion discovery xmrig miner privilege_escalation spyware stealer trojan
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies WinLogon for persistence
  persistence
- Windows security bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2