xmrig | 4ed1ce0f95d3a6ec92def2d34e192c4e8e89e51bd1ce40c24c249511b3ba2333

Resubmissions

28/08/2026, 19:20

260828-x2ds4ssepf10

28/08/2026, 18:20

260828-wyvrsa1xex10

Sharing

Copy URL Twitter E-mail

General

Target
caca.zip
Size 343.2MB
Sample260828-x2ds4ssepf
SHA256 4ed1ce0f95d3a6ec92def2d34e192c4e8e89e51bd1ce40c24c249511b3ba2333
MD5 559c36708d5aabf06cb40207d085fe65
SHA1 87f15f6204e66a0b6719db37f02adf1fef8ab8b3
SHA512 6ccf208e240b9f303ba75325ecf31b1dff8f64b0f028c538429575dfd6d6535cf766d1971aba41482a3d0aba003a21c460dfb3690f3a1c1977e576bdc0d20af7
SSDEEP 6291456:IriSn4G4HIriSn4G4HGriSn4G4HXriSn4G4HMriSn4G4HIriSn4G4HvriSn4G4Ht:FSn4VlSn4VTSn4VOSn4VJSn4VlSn4VGX
TLSH
T12F09336351D2AC3FA3A8AA2CD2C5C672B794CF6B10768844798067062BC75FF8C35F56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  caca/CRYPTO-MINER - Copie (4).exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  caca/CRYPTO-MINER - Copie (5) - Copie - Copie - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  caca/CRYPTO-MINER - Copie (5) - Copie - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution upx xmrig miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  caca/CRYPTO-MINER - Copie (5) - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  caca/CRYPTO-MINER - Copie (5).exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9
- Target
  caca/CRYPTO-MINER - Copie (6) - Copie - Copie - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  caca/CRYPTO-MINER - Copie (6) - Copie - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  caca/CRYPTO-MINER - Copie (6) - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  caca/CRYPTO-MINER - Copie - Copie - Copie - Copie.exe
- Size 38.5MB
- SHA256 d2ef2541261a2a8fbc9ec611fa7c733737b88a167e38cad8b775f4aec9de95cc
- MD5 7d8a462dc747437b64b73dc8f15e1c58
- SHA1 7e2ca95b9a0a29c98207960fdb4119eefa9f7622
- SHA512 46ccb34168d2f9e3d8f272ed750716b916123a94af89e1ff81091ac55e4f0853c42bedc938756efc9565e7f0336d8feedf83175ceb79958e44c67a70d6b5b5e4
- SSDEEP 786432:dvUMOtzF4fa7KZ71QtIOOjTNGCgeNwte6CuAZuaP7VTsa0JsvwMkUHO:dvUMOtRSa7KZJiIOK4cNwtCZZj32BHUH
- TLSH
  T19497331AA963097FF1D99238D2DAC13AB5526BDB1372C4DF195002131F87BEA9C36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution xmrig miner upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

Family: xmrig

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18