xmrig | 3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69 | Triage™

Login
Reports

Overview

overview

Static

static

3

Video.scr

windows10-2004-x64

Video.scr

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Video.scr
Size 5.9MB
Sample260910-w12ccawygs
SHA256 3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69
MD5 ca1fb1ad30189110cc225620dc537368
SHA1 bfc2de8f0b376a6f1ff1930a4f261709a27e92ec
SHA512 11737f00ac297040b40cfe6879b695c9900b6b2a691e0b4e12c190ed9918179d0b7a76415d67368d3767f7d357e1c0df202af618964986f72dcbac7bfd5ace17
SSDEEP 98304:RLNSThOfTCiFBXmfFs+JhTpCVoR8oMEOJ6Ty3RvX+A0eVObApY:bBfTCiUsBVSLOJgyBG3KTp
TLSH
T1C4563395F0806422F13D183615BA84F2B07CFCB343654A9F539E2A756D383D9263AB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig defense_evasion discovery execution miner persistence privilege_escalation pyinstaller upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Video.scr

Resource

win10v2004-20260513-en

windows10-2004-x64

16 signatures

150 seconds

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx

Behavioral task

behavioral2

Sample

Video.scr

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

16 signatures

150 seconds

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx

Malware Config

Extracted

Credentials

Protocol
ftp
Host
51.83.186.225
Port
21
Username
www
Password
anonymous

Extracted

Credentials

Protocol
ftp
Host
51.83.186.225
Port
21
Username
www
Password
123456

Extracted

Credentials

Protocol
ftp
Host
51.83.186.225
Port
21
Username
www
Password
admin

Extracted

Credentials

Protocol
ftp
Host
51.83.186.225
Port
21
Username
www
Password
password

Extracted

Credentials

Protocol
ftp
Host
51.83.186.225
Port
21
Username
www
Password
root

Targets

- Target
  Video.scr
- Size 5.9MB
- SHA256 3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69
- MD5 ca1fb1ad30189110cc225620dc537368
- SHA1 bfc2de8f0b376a6f1ff1930a4f261709a27e92ec
- SHA512 11737f00ac297040b40cfe6879b695c9900b6b2a691e0b4e12c190ed9918179d0b7a76415d67368d3767f7d357e1c0df202af618964986f72dcbac7bfd5ace17
- SSDEEP 98304:RLNSThOfTCiFBXmfFs+JhTpCVoR8oMEOJ6Ty3RvX+A0eVObApY:bBfTCiUsBVSLOJgyBG3KTp
- TLSH
  T1C4563395F0806422F13D183615BA84F2B07CFCB343654A9F539E2A756D383D9263AB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Network Service Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationpyinstallerupx

behavioral2

defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationpyinstallerupx

© 2018-2026

Terms | Privacy