xmrig | ebcdf536447cba219a13756c00c97b4ed5fea47f2cbf2283ea86e80216d3822e | Triage™

Login
Reports

Overview

overview

Static

static

3

Photo.scr

windows10-2004-x64

Photo.scr

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Photo.scr
Size 5.9MB
Sample260925-pmfp6axy9p
SHA256 ebcdf536447cba219a13756c00c97b4ed5fea47f2cbf2283ea86e80216d3822e
MD5 9f3069e77d062da63b7ba5c1f35e9937
SHA1 1f4d13fdd0bf0b0251b31b0afa2a9c2fb0b0140e
SHA512 31488f0805ff05d928e08699f7215e696e422b17dd96774fbd0c0f00becead1e0c2ba2734a15f5f559ee8cd9c679da16ea55ea2692eaf70ff5a904adabe13a45
SSDEEP 98304:RLJSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:LBfTCiUs0VSLOJgyBGUA8Ch8
TLSH
T1BD563345F4809837F139153625F884B2B07DBC7297244BDBA39E2AA56E317D83339A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig defense_evasion discovery execution miner persistence privilege_escalation pyinstaller upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Photo.scr

Resource

win10v2004-20260911-en

windows10-2004-x64

19 signatures

150 seconds

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx

Behavioral task

behavioral2

Sample

Photo.scr

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

16 signatures

150 seconds

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx

Malware Config

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
anonymous

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
123456

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
admin

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
password

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
root

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
123123

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
123

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
pass1234

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
www

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
wwwwww

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www
Password
www1

Extracted

Credentials

Protocol
ftp
Host
120.76.194.243
Port
21
Username
www

Targets

- Target
  Photo.scr
- Size 5.9MB
- SHA256 ebcdf536447cba219a13756c00c97b4ed5fea47f2cbf2283ea86e80216d3822e
- MD5 9f3069e77d062da63b7ba5c1f35e9937
- SHA1 1f4d13fdd0bf0b0251b31b0afa2a9c2fb0b0140e
- SHA512 31488f0805ff05d928e08699f7215e696e422b17dd96774fbd0c0f00becead1e0c2ba2734a15f5f559ee8cd9c679da16ea55ea2692eaf70ff5a904adabe13a45
- SSDEEP 98304:RLJSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:LBfTCiUs0VSLOJgyBGUA8Ch8
- TLSH
  T1BD563345F4809837F139153625F884B2B07DBC7297244BDBA39E2AA56E317D83339A4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Boot or Logon Autostart Execution

Port Monitors

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Port Monitors

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Network Service Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationpyinstallerupx

behavioral2

defense_evasiondiscoveryexecutionxmrigminerpersistenceprivilege_escalationpyinstallerupx

© 2018-2026

Terms | Privacy