xmrig | dcf3c26d5665c755943ff3261d47009dcdfab3835a610da67327fce9d75e2d01

General

Target
2026-09-05_73a827d4c5d5c4c3f1a02770ac5ccdfa_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig
Size 10.9MB
Sample260907-v3eexsdm9t
SHA256 dcf3c26d5665c755943ff3261d47009dcdfab3835a610da67327fce9d75e2d01
MD5 73a827d4c5d5c4c3f1a02770ac5ccdfa
SHA1 7e29c99716f505479d20708937b3e078c6b75847
SHA512 17d1c9079ce0e277a860328bcd0895a672ad8c4a068d523084187945805fab1cfc4a6b6dad295cffe59060fcbd893d52aef58875f738960624dada702f68b602
SSDEEP 196608:NAfrMK0z50OJEzEuDTvnO5tQ3ovumrGXp66GLD:NYYKXS1uDaOZmry6T
TLSH
T1B5B67C27F5A304FDC67EE17082579732BA3178A942307BAB1B90DA752F12F906B2D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-05_73a827d4c5d5c4c3f1a02770ac5ccdfa_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig
- Size 10.9MB
- SHA256 dcf3c26d5665c755943ff3261d47009dcdfab3835a610da67327fce9d75e2d01
- MD5 73a827d4c5d5c4c3f1a02770ac5ccdfa
- SHA1 7e29c99716f505479d20708937b3e078c6b75847
- SHA512 17d1c9079ce0e277a860328bcd0895a672ad8c4a068d523084187945805fab1cfc4a6b6dad295cffe59060fcbd893d52aef58875f738960624dada702f68b602
- SSDEEP 196608:NAfrMK0z50OJEzEuDTvnO5tQ3ovumrGXp66GLD:NYYKXS1uDaOZmry6T
- TLSH
  T1B5B67C27F5A304FDC67EE17082579732BA3178A942307BAB1B90DA752F12F906B2D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion xmrig miner spyware stealer trojan
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Detects executables containing URLs to raw contents of a Github gist
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

Detects executables containing URLs to raw contents of a Github gist

UPX dump on OEP (original entry point)

XMRig Miner payload

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2