xmrig | 1a33c5c6f599336ac34ee24957c1cd72704129aec660134120cbde98691ca873

General

Target
n.rar
Size 1.8MB
Sample261017-2wgp2ahb52
SHA256 1a33c5c6f599336ac34ee24957c1cd72704129aec660134120cbde98691ca873
MD5 d64655fd3bf5d18bf856030c9d1aad0e
SHA1 52afd3e70a3be1548aaf103a2e05c814b435ca03
SHA512 7e06631e614f36628cbd97dfd911e9797e9061fc767d2fbf0c24cd20c3eb43da95901fdf0ecbdd3ae42286491c4457d8b87865d7d281e399f0f84e18d47dba64
SSDEEP 49152:zimzvHSTe3l49i+iWleLiM8GzqD2iKX66oe0hsd:zHzvyC3YwLc3MX6Zq
TLSH
T184953373FAF11514468CC90EF358D8F111A1F5E0AD2F353A3E6671B68A1BE903B944AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Release/RetracCheat.exe
- Size 1.3MB
- SHA256 f12ed9be6610ed57fcd424c3a500eaa0b4360a5e6074c0285d121c6cf5f954d5
- MD5 e44226455bee4b5a57ee8648c9739cdf
- SHA1 d55599ea193df2a233ab2337b1afb417e1ef251f
- SHA512 57884da8447188484a313f544c45032ba885fb801bf2749039c0dd877315050543f224eaec82e942dc02ce3c44d5c9a41dbf02732629458113f81c4c8ffff0fb
- SSDEEP 24576:jq1hxFBLRoxolqHxxUAJRFsKa6jJBenV3ZRZbVZul3B9r:jqrxFFRsolYZJED6CnDRZs3
- TLSH
  T1A155BF5EF9E950FCD036E478D666A91BFB317819071059EB33E048981F2A6D06FBB603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer xmrig miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Release/loader.dll
- Size 108KB
- SHA256 a05d2429feac58d11614452baf855fc2a544d358f9c921c4af72f6de2b930eca
- MD5 4cb8b0d078ebbf7c665f97e6b8751569
- SHA1 b54ce3fc6ca38128a70acd790a07e096d0388767
- SHA512 0bc49f43894f16d34f826d508018189336a7227f5b2699aa29c5cb95eb4f7f6a74dfdf24848fb236fead4642be64afd788f49bc8c06c2e2a827ed9fd34f463a7
- SSDEEP 1536:wzp5OlwlrLjodwS5bgkYYLAtRTqPKb2c+gPINHspglNYy3fCYYmzPiHi:XKFwnPYltZqPKpINMpgl6mZYmzPi
- TLSH
  T1FFB30297B20048DAC67846F916831E01F9D0BC1447A5B3D32B3BA7DF9DA03C8A175EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer command_and_control xmrig miner
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral3 behavioral4