xmrig | 3bfd623077cfb6867be6a10ed2cb5ed83a9283a513ee768ae038ae81e11e749a

General

Target
2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
Size 917KB
Sample261026-w9dmmsgw7k
SHA256 3bfd623077cfb6867be6a10ed2cb5ed83a9283a513ee768ae038ae81e11e749a
MD5 9c74553e85f4afa5e7afed71c9f5021d
SHA1 85e6c2232e7b5228c2109e5e90cf8058b3a3a310
SHA512 81817fadcc799d80e420d5fb0d797f1576f6a89d3c38ff8821e3c5e85fd09a2d376f9173660e229ffb5345c291d26ff6570da29d7549c703dac9e419b831e5c0
SSDEEP 24576:+OGGwWBZaYfFmT+EP4fA2OVyekxdrMUPXiF:FGRWBZaYf8+x6yRHjPA
TLSH
T15E15121271D1C0F2E937043169B5CA716A7DFA701B788ADBA389036E5DB07C29D38B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-25_9c74553e85f4afa5e7afed71c9f5021d_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader
- Size 917KB
- SHA256 3bfd623077cfb6867be6a10ed2cb5ed83a9283a513ee768ae038ae81e11e749a
- MD5 9c74553e85f4afa5e7afed71c9f5021d
- SHA1 85e6c2232e7b5228c2109e5e90cf8058b3a3a310
- SHA512 81817fadcc799d80e420d5fb0d797f1576f6a89d3c38ff8821e3c5e85fd09a2d376f9173660e229ffb5345c291d26ff6570da29d7549c703dac9e419b831e5c0
- SSDEEP 24576:+OGGwWBZaYfFmT+EP4fA2OVyekxdrMUPXiF:FGRWBZaYf8+x6yRHjPA
- TLSH
  T15E15121271D1C0F2E937043169B5CA716A7DFA701B788ADBA389036E5DB07C29D38B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery xmrig miner persistence privilege_escalation spyware stealer upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2