xmrig | 03913c72d9f3704b1c20f6fd7f927ba878248133485640980d82c005aaa9f591

General

Target
2026-10-07_65779ff541d2a2103f7600ab41722beb_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_luca-stealer_magniber_njrat_ransomhub_remcos_stealc_stop_tofsee
Size 16.4MB
Sample261008-nxeeeafy8m
SHA256 03913c72d9f3704b1c20f6fd7f927ba878248133485640980d82c005aaa9f591
MD5 65779ff541d2a2103f7600ab41722beb
SHA1 a73b34c7f77cab59a9830442bb13b1b82d2c449f
SHA512 8038e43de195e489890357d91a6e02f6f70cbfc9b3eb2226f6bde79c132b4b48a61947d00c9a1000708315bbbed2cd5a2630ac3dc2cbfe0ac3d08166558f26ae
SSDEEP 393216:qAoghcflGviAB2uP3m9NKvgX/77hex2PkZvdm51aBx:qAoghcf4KAB2uP3m9NKvgXHhOEA
TLSH
T1E607E022B3D144F4D8BA8678896B5627E7B2BC754730D7CB23A4A6391F736C04D3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_65779ff541d2a2103f7600ab41722beb_amadey_coinminer_darkgate_elex_gcleaner_glassworm_hijackloader_icedid_luca-stealer_magniber_njrat_ransomhub_remcos_stealc_stop_tofsee
- Size 16.4MB
- SHA256 03913c72d9f3704b1c20f6fd7f927ba878248133485640980d82c005aaa9f591
- MD5 65779ff541d2a2103f7600ab41722beb
- SHA1 a73b34c7f77cab59a9830442bb13b1b82d2c449f
- SHA512 8038e43de195e489890357d91a6e02f6f70cbfc9b3eb2226f6bde79c132b4b48a61947d00c9a1000708315bbbed2cd5a2630ac3dc2cbfe0ac3d08166558f26ae
- SSDEEP 393216:qAoghcflGviAB2uP3m9NKvgX/77hex2PkZvdm51aBx:qAoghcf4KAB2uP3m9NKvgXHhOEA
- TLSH
  T1E607E022B3D144F4D8BA8678896B5627E7B2BC754730D7CB23A4A6391F736C04D3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit xmrig miner persistence privilege_escalation trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- XMRig Miner payload
  miner
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd
  NirCmd is a lightweight Windows command-line tool for automating system tasks
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2