xmrig | fa9f6386afed5013541cd902243eaa7bccdde213c1e454de180ea526b32e7e22

Sharing

Copy URL Twitter E-mail

General

Target
fa9f6386afed5013541cd902243eaa7bccdde213c1e454de180ea526b32e7e22
Size 14.3MB
Sample261027-d2tpsa1tg1
SHA256 fa9f6386afed5013541cd902243eaa7bccdde213c1e454de180ea526b32e7e22
MD5 08acc20adcf370c9c9c73cfc5b3e64dc
SHA1 8da1bc9e210b0aa660054dc39ae1181b99fab598
SHA512 0c2cfb4432739398218bd44d220acbc23243657542f4b2c6a7856e7d07dad8f5b9f0194e4ce0211d4b6a51bf85d4435ac0428dfb9cdc2a9f318b236874d76290
SSDEEP 393216:TOivWCOSPJCFXkCpPf28Nb2vKQLBQk3yrzKQyuhivYl:qiNSXnYUboKYQk3yrzK8l
TLSH
T108E633D1FDBF9183C4A588B6B77BC643DEA33888B514091701EF75B9849E71C8B86E42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  recoil-studio-main/backend/app/__init__.py
- Size 19B
- SHA256 403b4fe478f7ba224e735bf1cf958d022bc6977ec8d36536848bd54f2ae460a7
- MD5 610e5f45c9371bc1e97e76ad9d156060
- SHA1 50824d2d1a8430a29e12f9f2c0e20355d9b73f8d
- SHA512 e68ac80bd17b505bffb6853018b82a8c3a8b26734630b6016abeabe0ae5792e2cdea0f89addb572ba63a9a5b07745b41eb7f6d423c54e8e55db56c846539816b
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral1 behavioral2
- Target
  recoil-studio-main/backend/app/api/__init__.py
- Size 19B
- SHA256 06feb2de8fa6f3f70a791c203c4852ece8e899ac4cf6649e58907250f1d34646
- MD5 643fd66d132d01f7c1b8a9540adc04c1
- SHA1 0035521afef203e954ff1f6837af1bc24b61a4b4
- SHA512 fc483338ea1516ba84cf8392e091f6c57688d2c6fa7b89e5d55975c6cf129196cf0e009cc3fd2af8103ebadd2e163d7d2802de9e6e4490a830d69b581bd5bb14
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  recoil-studio-main/backend/app/api/lua.py
- Size 1KB
- SHA256 e7ca478f33bdf3ff0a7d7dfcb70a46bbc753d4cf132c9dc75dea9ae767db1f59
- MD5 2ce4e1e468dcbbbed1644928b9711802
- SHA1 5bd0d7d56379e12a7a1f41992cd91190a530cbe2
- SHA512 5cbb161ac84eeaa4758c8473361f5079679de776c01bc2c60993b1ec975a2ed1f711f0d6f0bd9c6d6ab17d0be7f94c540221e7bc550217b0c66e65a8076b808d
- TLSH
  T12731CD4EC8902D70C39281B1A55798A1317C9CC3DB859439BEAC4399BF8AE29C8F94DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  recoil-studio-main/backend/app/api/pattern.py
- Size 2KB
- SHA256 85a73ccb624771112cb079e1ca5b6ec29c0c07ed1b1d2e852a59fa594872f2ed
- MD5 f47253565a38f961ed492aa8dd16ada8
- SHA1 5f64e109c3918a23dc6dd87e02b1fb161f6e1b15
- SHA512 7094dd9045f356d55dc94dfec815b83e60a678d08dab9c8ac7b4656cb617daf7c5fb9a328a96204f40a3cd9e3e89bfe93a8b2897040ea538d23b66b38b4988a7
- TLSH
  T1D541BC47CC20BC69C59F816EAC264602B19A99531EC26527FACC43500F1F6568EF1FEB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  recoil-studio-main/backend/app/core/__init__.py
- Size 20B
- SHA256 41481feb089beb0a66d1d017e0f3c52fc7564b49c5498bd12aa740d54708e549
- MD5 fac748507a64189f0b275c4b3606f9e9
- SHA1 68c927bd07b28a5ba950ecfa1fc7e7582f41013e
- SHA512 5ed41c029750442856544f0dcb4faf26b7232f5b4f0c494038260f83e233d701978f987e98725d91f5102e6be94bee3a925ecced78f899f08f24a555b9015797
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  recoil-studio-main/backend/app/models/__init__.py
- Size 22B
- SHA256 e79a2717002d3d175d38a407bf7b0c3f100d7552badad22ef6ddf40a7936541d
- MD5 db2b87faf38413e151fa26aa333d281a
- SHA1 ad3668df465c299a6c3bf39d86155d7ca75749f9
- SHA512 8f720eb9326ad0afb011048bd1b75e557535ae4e069dfeafbb762c8aa1610f94dda029f812267303aedd393385d5161692fa0195cc162abd878534793cec5302
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11 behavioral12
- Target
  recoil-studio-main/backend/app/models/schemas.py
- Size 2KB
- SHA256 dd10147ed9519f521cca4b855b721df4494a3cd0f012bc06b0216e738698521a
- MD5 1d166faaa203519f1170b23cfdbfb043
- SHA1 ab743b73c917310e8f9d9fb097d1219c0fd314a5
- SHA512 6f552043f4ce476a2ccd9fa068bd1e8ea0a0bc041cc43d3c5fce685da7cd9a1dbf11afbe5950c069b6414113375619aca745c3a29d303e3266b95d2c2d693c11
- TLSH
  T11C413905CD81EC908D9F28638E758209B635678B56416836FEF447A60F193C7CFA2789
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  recoil-studio-main/backend/app/services/__init__.py
- Size 24B
- SHA256 43493dfda709512e78bf30d32196bece92ad9e601b867a3a8aa0e6670a463a3d
- MD5 28034cae75511d5741ff8a937a6e847a
- SHA1 d2654f7ba97cdf187c48aa76247fd4c74f5ff0cf
- SHA512 7a5e3e2726b24bdff852c8812fe7de9999274425bb54bc546b20ec99055fbaec37912fa474d3835916b4dec0e328b2e76ba7a76cb07b4ed1b088115ebdd9b245
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  recoil-studio-main/backend/app/services/lua_generator.py
- Size 7KB
- SHA256 d9508dc559186019368535b3ac696224aabdf50b452abd05a55c6e2a718ab794
- MD5 7bfd5ee1540a462fdfe3b2b36f3574b5
- SHA1 14eaf669836f4e517fa72d5fb97c15e95175aeaa
- SHA512 f0bffa752b9344c1ab264bd45f40f2fe913a81a944a7fc9077e37b5e8939f0242c2db5eb220c0e4e06b82adc6789663b53cc1ecfa9eaadc15986bea04466ddee
- SSDEEP 96:+5NA5JzRbMO9DziBEfOhwpWk64iSDxnZ3zQ5JhrlObrcKXuzC:+5aF59DzQEfWOFG5nrlObICwC
- TLSH
  T12CE1656F524339F29203856FC6820939BA3435535D099A19BDFD86C42F987BCC5F0BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  recoil-studio-main/backend/app/services/pattern_detector.py
- Size 3KB
- SHA256 3ac6637eaf42b8147ef6f284ac121e4ff59f77e744f43a2605fc40e682a44cf7
- MD5 11459eb82aa3fc1aea346f3304659dcf
- SHA1 e79b2c3967f8126caccae0788cc0ceef44ee611b
- SHA512 ae2a371144411ed8286fe5ecfc0d69339f3b24b975c198e043bed86c2d9dcf9966567454cbfa4fe47d564ac48b173e0b12d5f11664e6d02eef5d284f2448e68b
- TLSH
  T15A81A699C8427898D3B7807A0CCAC632632998A355C21D3A3FDDC7641FA275FCFE4595
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  recoil-studio-main/backend/load.exe
- Size 15.5MB
- SHA256 fea0e9a8d691ca32c084f22beb7268cb0e175025b40dc93b31df0e975372031f
- MD5 8245534d6481add42a79bb9351a4eced
- SHA1 676278d9044dbaa1bc784994f039cbeed40edca8
- SHA512 01ae5fafddae9df14672d35f8ff741777d1cc744fe3181380252d347dbc031ece32febf42b8fede4174f379b2c8ef53442dfb4a2e71907b798e965bd286e2018
- SSDEEP 393216:CLwSP8wCs3DQ1nYu/DaIv8RhuD0cfRmateDpO3zyW:CESncnFeP40+mateDpOjyW
- TLSH
  T1ADF623C361FDA2B4D1C347605D82738F6C88B4665DA4D95A38CE0C03B916EAD86CE7B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xmrig miner persistence
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral21 behavioral22
- Target
  recoil-studio-main/backend/main.py
- Size 1KB
- SHA256 e5473927c823d58711abd155aa69d9be87949489a0b424235eacdcf4d45843e8
- MD5 77fc6f88a67ff5f34a59e37aa1192b11
- SHA1 c859a7c6fde17caa778ce3478612b0dabd6ff071
- SHA512 d8e2966c05e736819683cc25ba745c49504311ca97532b0e1e2b293eaa1c0d1ff9a4c5df0682ac897a674f6c77c345d35ab3a4f93284dd916cc3ecd7fc5f8891
- TLSH
  T171317648D8403640C81AD3EC4360DE1271AA2DBF1E99A054F69C037C1FAE7EB85F877A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  recoil-studio-main/backend/static/assets/index-BJP48MIC.js
- Size 119KB
- SHA256 0706eacbea5b0d0f9d333d8649c5d6b29058be8845ec39ce18edf537be31d938
- MD5 be67257edfec7c89e99bb5658e7675ae
- SHA1 b846b8415445f6d83e35e68911f0871ffc2b4a0f
- SHA512 318f7392ba5bae03e394941e49abf6234206e292f71a0c700a84f4bf1f5cbf0a829c94da9f3138cfc68c88860cc70897d5d9bb28c438f078a447fcb71f42d1e9
- SSDEEP 1536:ilzWSUUlEzd62E8OlF/VgNWq9EhATgUgObTG6aYp0v1V/wtqwPDPOuXcCi+:kzWS6zd6fNgN9ECsUgYG6P+VYqUOuw+
- TLSH
  T176C32AE43192B47293F619E1407B0402F32A2E157449C8E4B1ACADDF3E7685652BBFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  recoil-studio-main/backend/static/index.html
- Size 454B
- SHA256 d6a0057a335e3fdc8ca0a307a0c1ca4b8b821a7359269162b3510155f3bf4ea1
- MD5 3756de5ef304bdbcd1ae4cdb6d775d3a
- SHA1 7a8c3379d1d52e9184d742767f0fba9262e232c5
- SHA512 70d0eb5165c03b3e51a202a990eeaa2c0eb7085c4be1298e15c1cc3e71b0d06028dc67fc148958ad4b876da06f57bd756ef6442bf374f229bfa575f0b0374891
- TLSH
  T106F05C4198E08D16833046256DC1FA099943E78787899D4872FBA07D1FC4B86CEDF9FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  recoil-studio-main/backend/static/vite.svg
- Size 1KB
- SHA256 4a748afd443918bb16591c834c401dae33e87861ab5dbad0811c3a3b4a9214fb
- MD5 8e3a10e157f75ada21ab742c022d5430
- SHA1 f7f39d7237b791a945d52a5cd7a8fb365f313366
- SHA512 fbf065e26d907454cb432a17d831f448e1c3df0f33cd681ccc52b63e5bc26bc9e4de08591a2de579e5b05219fcffd3b4d4261ada6fa55299e731343df860488d
- TLSH
  T12031451FDA7FD4FEC0A6CB48E612B047962C30D95E41C5B4D9845F0E64A19F17C0AA64
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  recoil-studio-main/build.bat
- Size 174B
- SHA256 3f63410c82c994ea8e7d0512a4981e5af80ffedd3a0641cd8cfef9c75f4729f9
- MD5 f09da7a2d9f7cb3e8d9fc7a6d92934ee
- SHA1 ceb65d57541d121f4ade955491816b3c1ee6c998
- SHA512 8417feebe1857a80e86fffe51ea0451b0cc4255f422d092b9722843446466a1af62b75138d8a7c6827aeb8e44f5370ca281b3e4262ee267a33e5460395ff6b9b
- TLSH
  T100C0123335040000A65A66815A7133D8E818416706149C949453242855C9A66656D49E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32