xmrig | 0acde40816e0756db5bc5f3a7d06b497f2664041f89bf04195d3396c3e227343

General

Target
2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
Size 18.1MB
Sample260930-tae1babh78
SHA256 0acde40816e0756db5bc5f3a7d06b497f2664041f89bf04195d3396c3e227343
MD5 e1cf636e43a2f22de4ff099063ab5316
SHA1 bcd396f59a608bd0dbde0c74ebfbcce8dd983f52
SHA512 39299ee88448f4c3b226aeea9cf7e0c6917b26fba42583446cf8dfd37ed540af7712c1fcbd760f28216d35233c214c6322cb39bc14dae0c6330ce0615aa42e22
SSDEEP 196608:JRC/NM0rDoxrix2PkZvdAv5n1gpgogUFrpu2G35EQKqwq1A02u8Ru:Jhex2PkZvdm51PogUF4ZyQKqQfu8k
TLSH
T16C176C57B27600DDC4BAC03886577233FAB17C58833467AB569097652F72BA86F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_e1cf636e43a2f22de4ff099063ab5316_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
- Size 18.1MB
- SHA256 0acde40816e0756db5bc5f3a7d06b497f2664041f89bf04195d3396c3e227343
- MD5 e1cf636e43a2f22de4ff099063ab5316
- SHA1 bcd396f59a608bd0dbde0c74ebfbcce8dd983f52
- SHA512 39299ee88448f4c3b226aeea9cf7e0c6917b26fba42583446cf8dfd37ed540af7712c1fcbd760f28216d35233c214c6322cb39bc14dae0c6330ce0615aa42e22
- SSDEEP 196608:JRC/NM0rDoxrix2PkZvdAv5n1gpgogUFrpu2G35EQKqwq1A02u8Ru:Jhex2PkZvdm51PogUF4ZyQKqQfu8k
- TLSH
  T16C176C57B27600DDC4BAC03886577233FAB17C58833467AB569097652F72BA86F3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2