xmrig | 05e838e7203851c384636598d3c7dfa68f5973e0cb3ac918337d874384526bcc

General

Target
2026-09-10_a50bf26a9b8544fb144b82addbb9712b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 16.7MB
Sample260910-pqc4facj6y
SHA256 05e838e7203851c384636598d3c7dfa68f5973e0cb3ac918337d874384526bcc
MD5 a50bf26a9b8544fb144b82addbb9712b
SHA1 9c9a0814d2ffc8794916cf287abf021842b82aaa
SHA512 8ff7cf240bdbca8b688bce20178a93f770045e14ace54ab65d54d3fad8a88053be4796e400962bc0c8e4e1389ed9fb9a65c1c07b7323ae34a1742ecb7d92cc4d
SSDEEP 196608:9jcOttmXtAeeIGcOI7TIvTkxUSv/D76YmS:9gctmXKNc+gFDGPS
TLSH
T1FD078C43E87515E8C0AD9276C6769663BB307C884B3163D36B60F6382F36BD0AE79741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-10_a50bf26a9b8544fb144b82addbb9712b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 16.7MB
- SHA256 05e838e7203851c384636598d3c7dfa68f5973e0cb3ac918337d874384526bcc
- MD5 a50bf26a9b8544fb144b82addbb9712b
- SHA1 9c9a0814d2ffc8794916cf287abf021842b82aaa
- SHA512 8ff7cf240bdbca8b688bce20178a93f770045e14ace54ab65d54d3fad8a88053be4796e400962bc0c8e4e1389ed9fb9a65c1c07b7323ae34a1742ecb7d92cc4d
- SSDEEP 196608:9jcOttmXtAeeIGcOI7TIvTkxUSv/D76YmS:9gctmXKNc+gFDGPS
- TLSH
  T1FD078C43E87515E8C0AD9276C6769663BB307C884B3163D36B60F6382F36BD0AE79741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation spyware stealer trojan
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled T
- Executes dropped EXE
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2