xmrig | 2db57a57eba5e755ffded82b42d1ac93e977a04d56b9b8948537c2facc7f2abc

General

Target
2026-09-21_995f8d4fb0d8b2b72944a3bb43a8437f_akira
Size 48.7MB
Sample260922-nhc8ssda79
SHA256 2db57a57eba5e755ffded82b42d1ac93e977a04d56b9b8948537c2facc7f2abc
MD5 995f8d4fb0d8b2b72944a3bb43a8437f
SHA1 1b9b10f8ade2fd1f2b94a9ca863ef10568fe573d
SHA512 030ebb3ea1331469385a83c4f100ef6aa0b1291cf28a091036ff11941b7a7988759d1e3178fcacbf767fe5ff72bd2d6323712dd94b7ec11653fef927862383e0
SSDEEP 1572864:8ugyTp7Rw4/HSm7M+5lWJEhAfbDhRFWf2pU:8uPU4zP58JgADDhyupU
TLSH
T1E8B733527B440F6CEAA2857D82A7837F7AF933466312EB67046A96305F1BDD09F0270D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-21_995f8d4fb0d8b2b72944a3bb43a8437f_akira
- Size 48.7MB
- SHA256 2db57a57eba5e755ffded82b42d1ac93e977a04d56b9b8948537c2facc7f2abc
- MD5 995f8d4fb0d8b2b72944a3bb43a8437f
- SHA1 1b9b10f8ade2fd1f2b94a9ca863ef10568fe573d
- SHA512 030ebb3ea1331469385a83c4f100ef6aa0b1291cf28a091036ff11941b7a7988759d1e3178fcacbf767fe5ff72bd2d6323712dd94b7ec11653fef927862383e0
- SSDEEP 1572864:8ugyTp7Rw4/HSm7M+5lWJEhAfbDhRFWf2pU:8uPU4zP58JgADDhyupU
- TLSH
  T1E8B733527B440F6CEAA2857D82A7837F7AF933466312EB67046A96305F1BDD09F0270D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution xmrig miner persistence spyware stealer upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies WinLogon for persistence
  persistence
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects executables Discord URL observed in first stage droppers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables using Telegram Chat Bot
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2