xmrig | 915221495858e8edd4fad91b89e0c6ba3fe963ac30d3b1e456f1a94e9eecb3f5

General

Target
2026-10-16_99e309da9345ad475a86fea4d4719220_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 32.7MB
Sample261017-ndabcad19q
SHA256 915221495858e8edd4fad91b89e0c6ba3fe963ac30d3b1e456f1a94e9eecb3f5
MD5 99e309da9345ad475a86fea4d4719220
SHA1 c98788873d2ea97e250be6f435121fb6812affbf
SHA512 b9027241c2abb5c14e66df5b25a8f2b09e718edc0bc03dd6211b4155290858e4170563e177cbce9898d80ad7cd12e4b0331fe3c3a61598feb0aeec811032e2b9
SSDEEP 196608:EczYjCL35o5wVqwp0GLKawmiDMbvBJIQeoO:ESYjEZ8iv7IQeoO
TLSH
T1F2774BE3F8A31AD4D8EAC7749272412AB6623C190B7523D70694BF141F3EBD0E6B6705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-16_99e309da9345ad475a86fea4d4719220_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 32.7MB
- SHA256 915221495858e8edd4fad91b89e0c6ba3fe963ac30d3b1e456f1a94e9eecb3f5
- MD5 99e309da9345ad475a86fea4d4719220
- SHA1 c98788873d2ea97e250be6f435121fb6812affbf
- SHA512 b9027241c2abb5c14e66df5b25a8f2b09e718edc0bc03dd6211b4155290858e4170563e177cbce9898d80ad7cd12e4b0331fe3c3a61598feb0aeec811032e2b9
- SSDEEP 196608:EczYjCL35o5wVqwp0GLKawmiDMbvBJIQeoO:ESYjEZ8iv7IQeoO
- TLSH
  T1F2774BE3F8A31AD4D8EAC7749272412AB6623C190B7523D70694BF141F3EBD0E6B6705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery persistence defense_evasion execution xmrig miner privilege_escalation spyware stealer trojan
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Executes dropped EXE
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2